RE: [ActiveDir] GPO Permissions with .vbs
If the logon script is a batch file
then:
start wscript script.vbs
should make the script just carry on; if it's a _vbscript_
logon scrip then something like:
oshell.run "wscript.exe
script.vbs"
will launch the
process and not wait for it to complete.
I'll leave you to give the perl code
:-)
joeware.netfine now - I'd guess it was just one
of those things that make life such fun!
Steve
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of
joeSent: 10 October 2005 15:37To:
ActiveDir@mail.activedir.orgSubject: RE: [ActiveDir] GPO Permissions
with .vbs
Cute script. Forgot all about datediff.
It doesn't create a window but will it hold up logon script
flow? If not, cool.
Website is working fine... must be a DNS issue of some
sort. Go figure. ;o)
Pinging joeware.net [66.152.98.204] with 32 bytes of
data:
Obviously you won't be able to connect with IP, it used
host headers for the redirect.
joe
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Steve
RochfordSent: Monday, October 10, 2005 4:12 AMTo:
ActiveDir@mail.activedir.orgSubject: RE: [ActiveDir] GPO Permissions
with .vbs
_vbscript_ version below. If you launch this
with:
wscript scriptname.vbs
then it won't create a window (so you don't need quiet)
I've added an inital check so the program just terminates if the needed time has
passed.
Joe - I can't get to your web site today; nslookup
doesn't give me an IP address. Not sure if that's a problem with your site or
our DNS ...
Steve
set
oShell=createobject("wscript.shell")sTime="10 oct 2005
09:09"scmd="c:\\progra~1\\intern~1\\iexplore.exe -new www.joeware.net"if datediff("s",now,sTime)
0 then do while datediff("s",now,sTime)
0 wscript.sleep 6 loop
oShell.run sCmdend if
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of
joeSent: 08 October 2005 04:21To:
ActiveDir@mail.activedir.orgSubject: RE: [ActiveDir] GPO
Permissions with .vbs
Now that I have a nice steak from Texas Roadhouse in
my belly I can think straight. :o)
Assuming the perl script is called
timedfire.pl
my
$d1="10/7/2005";my $t1="23:04";my $cmd="c:\\progra~1\\intern~1\\iexplore.exe -new
www.joeware.net";
my
($mon,$day,$year)=split(/\//,$d1);my ($hour,$min)=split(/:/,$t1);my
$cmp=GetCmpVal($year,$mon,$day,$hour,$min);$curr=GetCurrentTime();while($cmp$curr){
sleep 60; $curr=GetCurrentTime();}
exec $cmd;
sub
GetCmpVal{ return
sprintf("%04s%02s%02s%02s%02s",@_);}
sub
GetCurrentTime{ my @lt=localtime(); return
GetCmpVal($lt[5]+1900,$lt[4]+1,$lt[3],$lt[2],$lt[1]);}
You should be able to put in the logon
script
quiet timedfire.pl
And you can get quiet from http://www.joeware.net/win/free/tools/quiet.htm
That can be further reduced but I wanted it to be
readable. If someone wants to convert to _vbscript_, that might be fun for
people who don't do perl.
joe
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Brian
DesmondSent: Friday, October 07, 2005 9:15 PMTo:
ActiveDir@mail.activedir.orgSubject: RE: [ActiveDir] GPO
Permissions with .vbs
This should be a piece of
cake to do with a .net app. It's got an easy option to hide from the taskbar,
so you don't have to call the Win32 API to do that (not that its hard...), it
has a couple of timer classes, and it has a Process class you can use to kick
off a process. Sounds like a compelling reason to learn C# or VB.Net to me.
;)
Thanks,Brian Desmond
[EMAIL PROTECTED]
c -
312.731.3132
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of
joeSent: Friday, October 07, 2005 9:02 PMTo:
ActiveDir@mail.activedir.orgSubject: RE: [ActiveDir] GPO
Permissions with .vbs
Oh I just chased back through this thread... You want to
fire up IE, I didn't catch that before, I didn't look that close at the
specific process you wanted fire, just that you wanted to fire a process. You
should still be able to do this with a startup script with AT as long as you
specify interactive, it should pop in the current interactive session but I
would be concerned of the security context it runs in which would be
localsystem. In order to schedule something in the security context of another
ID you will need to be able to specify userid/password which isn't fun either
since someone will probably be able to see it if they are
bright.
What you want is something that opens an IE window in the
context of the currentuser at a specified time. I am not aware of
anything that will do that. You almostneed a special app that can be
launched by the user in the logon script in their security context that will
sleep until the specified time and then fire the app. Here is a point where
bei
RE: [ActiveDir] GPO Permissions with .vbs
joeware.netfine now -
I'd guess it was just one of those things that make life such
fun!
Like DNS.
;o)
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Steve
RochfordSent: Tuesday, October 11, 2005 5:54 AMTo:
ActiveDir@mail.activedir.orgSubject: RE: [ActiveDir] GPO Permissions
with .vbs
If the logon script is a batch file
then:
start wscript script.vbs
should make the script just carry on; if it's a _vbscript_
logon scrip then something like:
oshell.run "wscript.exe
script.vbs"
will launch the
process and not wait for it to complete.
I'll leave you to give the perl code
:-)
joeware.netfine now - I'd guess it was just one
of those things that make life such fun!
Steve
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of
joeSent: 10 October 2005 15:37To:
ActiveDir@mail.activedir.orgSubject: RE: [ActiveDir] GPO Permissions
with .vbs
Cute script. Forgot all about datediff.
It doesn't create a window but will it hold up logon script
flow? If not, cool.
Website is working fine... must be a DNS issue of some
sort. Go figure. ;o)
Pinging joeware.net [66.152.98.204] with 32 bytes of
data:
Obviously you won't be able to connect with IP, it used
host headers for the redirect.
joe
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Steve
RochfordSent: Monday, October 10, 2005 4:12 AMTo:
ActiveDir@mail.activedir.orgSubject: RE: [ActiveDir] GPO Permissions
with .vbs
_vbscript_ version below. If you launch this
with:
wscript scriptname.vbs
then it won't create a window (so you don't need quiet)
I've added an inital check so the program just terminates if the needed time has
passed.
Joe - I can't get to your web site today; nslookup
doesn't give me an IP address. Not sure if that's a problem with your site or
our DNS ...
Steve
set
oShell=createobject("wscript.shell")sTime="10 oct 2005
09:09"scmd="c:\\progra~1\\intern~1\\iexplore.exe -new www.joeware.net"if datediff("s",now,sTime)
0 then do while datediff("s",now,sTime)
0 wscript.sleep 6 loop
oShell.run sCmdend if
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of
joeSent: 08 October 2005 04:21To:
ActiveDir@mail.activedir.orgSubject: RE: [ActiveDir] GPO
Permissions with .vbs
Now that I have a nice steak from Texas Roadhouse in
my belly I can think straight. :o)
Assuming the perl script is called
timedfire.pl
my
$d1="10/7/2005";my $t1="23:04";my $cmd="c:\\progra~1\\intern~1\\iexplore.exe -new
www.joeware.net";
my
($mon,$day,$year)=split(/\//,$d1);my ($hour,$min)=split(/:/,$t1);my
$cmp=GetCmpVal($year,$mon,$day,$hour,$min);$curr=GetCurrentTime();while($cmp$curr){
sleep 60; $curr=GetCurrentTime();}
exec $cmd;
sub
GetCmpVal{ return
sprintf("%04s%02s%02s%02s%02s",@_);}
sub
GetCurrentTime{ my @lt=localtime(); return
GetCmpVal($lt[5]+1900,$lt[4]+1,$lt[3],$lt[2],$lt[1]);}
You should be able to put in the logon
script
quiet timedfire.pl
And you can get quiet from http://www.joeware.net/win/free/tools/quiet.htm
That can be further reduced but I wanted it to be
readable. If someone wants to convert to _vbscript_, that might be fun for
people who don't do perl.
joe
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Brian
DesmondSent: Friday, October 07, 2005 9:15 PMTo:
ActiveDir@mail.activedir.orgSubject: RE: [ActiveDir] GPO
Permissions with .vbs
This should be a piece of
cake to do with a .net app. It's got an easy option to hide from the taskbar,
so you don't have to call the Win32 API to do that (not that its hard...), it
has a couple of timer classes, and it has a Process class you can use to kick
off a process. Sounds like a compelling reason to learn C# or VB.Net to me.
;)
Thanks,Brian Desmond
[EMAIL PROTECTED]
c -
312.731.3132
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of
joeSent: Friday, October 07, 2005 9:02 PMTo:
ActiveDir@mail.activedir.orgSubject: RE: [ActiveDir] GPO
Permissions with .vbs
Oh I just chased back through this thread... You want to
fire up IE, I didn't catch that before, I didn't look that close at the
specific process you wanted fire, just that you wanted to fire a process. You
should still be able to do this with a startup script with AT as long as you
specify interactive, it should pop in the current interactive session but I
would be concerned of the security context it runs in which would be
localsystem. In order to schedule something in the security context of another
ID you will need to be able to specify userid/password which isn't fun either
since someone will probably be able to see it if they are
bright.
What you want is something that opens
RE: [ActiveDir] GPO Permissions with .vbs
_vbscript_ version below. If you launch this
with:
wscript scriptname.vbs
then it won't create a window (so you don't need quiet)
I've added an inital check so the program just terminates if the needed time has
passed.
Joe - I can't get to your web site today; nslookup
doesn't give me an IP address. Not sure if that's a problem with your site or
our DNS ...
Steve
set
oShell=createobject("wscript.shell")sTime="10 oct 2005
09:09"scmd="c:\\progra~1\\intern~1\\iexplore.exe -new www.joeware.net"if datediff("s",now,sTime)
0 then do while datediff("s",now,sTime)
0 wscript.sleep 6 loop
oShell.run sCmdend if
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of
joeSent: 08 October 2005 04:21To:
ActiveDir@mail.activedir.orgSubject: RE: [ActiveDir] GPO
Permissions with .vbs
Now that I have a nice steak from Texas Roadhouse in
my belly I can think straight. :o)
Assuming the perl script is called
timedfire.pl
my
$d1="10/7/2005";my $t1="23:04";my $cmd="c:\\progra~1\\intern~1\\iexplore.exe -new
www.joeware.net";
my
($mon,$day,$year)=split(/\//,$d1);my ($hour,$min)=split(/:/,$t1);my
$cmp=GetCmpVal($year,$mon,$day,$hour,$min);$curr=GetCurrentTime();while($cmp$curr){
sleep 60; $curr=GetCurrentTime();}
exec $cmd;
sub
GetCmpVal{ return
sprintf("%04s%02s%02s%02s%02s",@_);}
sub
GetCurrentTime{ my @lt=localtime(); return
GetCmpVal($lt[5]+1900,$lt[4]+1,$lt[3],$lt[2],$lt[1]);}
You should be able to put in the logon
script
quiet timedfire.pl
And you can get quiet from http://www.joeware.net/win/free/tools/quiet.htm
That can be further reduced but I wanted it to be
readable. If someone wants to convert to _vbscript_, that might be fun for
people who don't do perl.
joe
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Brian
DesmondSent: Friday, October 07, 2005 9:15 PMTo:
ActiveDir@mail.activedir.orgSubject: RE: [ActiveDir] GPO
Permissions with .vbs
This should be a piece of
cake to do with a .net app. It's got an easy option to hide from the taskbar,
so you don't have to call the Win32 API to do that (not that its hard...), it
has a couple of timer classes, and it has a Process class you can use to kick
off a process. Sounds like a compelling reason to learn C# or VB.Net to me.
;)
Thanks,Brian Desmond
[EMAIL PROTECTED]
c -
312.731.3132
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of
joeSent: Friday, October 07, 2005 9:02 PMTo:
ActiveDir@mail.activedir.orgSubject: RE: [ActiveDir] GPO
Permissions with .vbs
Oh I just chased back through this thread... You want to
fire up IE, I didn't catch that before, I didn't look that close at the
specific process you wanted fire, just that you wanted to fire a process. You
should still be able to do this with a startup script with AT as long as you
specify interactive, it should pop in the current interactive session but I
would be concerned of the security context it runs in which would be
localsystem. In order to schedule something in the security context of another
ID you will need to be able to specify userid/password which isn't fun either
since someone will probably be able to see it if they are
bright.
What you want is something that opens an IE window in the
context of the currentuser at a specified time. I am not aware of
anything that will do that. You almostneed a special app that can be
launched by the user in the logon script in their security context that will
sleep until the specified time and then fire the app. Here is a point where
being an admin with programming skills is nice though you may be able to do
this with a script. Have the script fire another process that hides itself
from the task bar and pops into the screen at the designated
time.
I will think aboutthis. There might be a way to
pull this off with a perl script.
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Harding,
DevonSent: Friday, October 07, 2005 4:46 PMTo:
ActiveDir@mail.activedir.orgSubject: RE: [ActiveDir] GPO
Permissions with .vbs
How would I use
schtask to assign to more than one computer. It seems like that may be
our only option.
I cant believe its
that difficult to get a popup of IE on ALL users desktop at a specific
time.
-Devon
From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]
On Behalf Of Kamlesh
ParmarSent: Friday, October
07, 2005 2:45 PMTo:
ActiveDir@mail.activedir.orgSubject: Re: [ActiveDir] GPO Permissions
with .vbs
This is specific
to opening the internet explorer with higher privileges... (nothing to do with
script runing at logon or startup)If I kne
RE: [ActiveDir] GPO Permissions with .vbs
I think that the difficulty is because you're trying to schedule a task to do somethingwhich (I think) it was never intended to do. All the scheduled tasks I use are ones which run without interfering with what's happening on the desktop - the last thing I want is for (eg) a backup process to pop up on my screen while I'm trying to do something. As Joe said, I think this is a custom app type of job and, as I hope you can see from his and my scripts, it's actually quite easy to do it without having to write a major app. Steve From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Harding, DevonSent: 07 October 2005 21:46To: ActiveDir@mail.activedir.orgSubject: RE: [ActiveDir] GPO Permissions with .vbs How would I use schtask to assign to more than one computer. It seems like that may be our only option. I cant believe its that difficult to get a popup of IE on ALL users desktop at a specific time. -Devon
Re: [ActiveDir] GPO Permissions with .vbs
unless you MTed it which you won't be doing from BAT very soon. All added complexity. joe From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Kamlesh ParmarSent: Saturday, October 08, 2005 5:58 AMTo: ActiveDir@mail.activedir.orgSubject: Re: [ActiveDir] GPO Permissions with .vbs Interactive doesn't help in LOCALSYSTEM context for GUI apps, only CMD.EXE canpop in LOCALSYSTEM context. I like to as far as possible, use the tools which come with os itself, so using Perl for this stuff might be overkill. Anyway, for scheduling it on many computers, 1) directly running schtasks.exe against list of computers, (I suggest this method if count is small) a) create normal domain user account, with complex password, for running the task. b)create a text file containing all the comps where you want to schedule the job. say, comps.txt c) put the following text into batch file, and save the batch file in same directory as comps.txt :: Start Copy Here @ECHO OFF for /F %%A in (comps.txt) do ( echo Scheduling the task on %%A ... schtasks /S %%A /create /SC WEEKLY /D MON,TUE,WED,THU,FRI /TN mypopup /TR C:\PROGRA~1\INTERN~1\iexplore.exe -new http://www.domain.com /ST 11:00 /IT /RU runuser /RP runpasswd /F) :: End Copy Here d) Make appropriate changes in the script above, for taskname(TN), username(RU), password(RP) now from your admin workstation, make sure you are logged in with user, who has admin rights over all the comps in question. Run the batch file, it will connect to each computer and schedule the task under specified user context. once, you verify that it is all scheduled, replace the actual username, password from batch file with dummies, and save it for future use. 2) If you want to use _vbscript_, coupled with GP deployment, then u will have to hide the credentials. As others suggested, many waysto do it, make actual app in VB, or use tools like CPAU from joeware, to encrypt the credential. (http://www.joeware.net/win/free/tools/cpau.htm ) I use AutoIt from (http://www.autoitscript.com/autoit3/index.php) (damn cool replacement for VB apps for small tasks) If you choose to work with AutoIt, and get stuck, let me know... -- Kamlesh On 10/8/05, joe [EMAIL PROTECTED] wrote: Oh I just chased back through this thread... You want to fire up IE, I didn't catch that before, I didn't look that close at the specific process you wanted fire, just that you wanted to fire a process. You should still be able to do this with a startup script with AT as long as you specify interactive, it should pop in the current interactive session but I would be concerned of the security context it runs in which would be localsystem. In order to schedule something in the security context of another ID you will need to be able to specify userid/password which isn't fun either since someone will probably be able to see it if they are bright. What you want is something that opens an IE window in the context of the currentuser at a specified time. I am not aware of anything that will do that. You almostneed a special app that can be launched by the user in the logon script in their security context that will sleep until the specified time and then fire the app. Here is a point where being an admin with programming skills is nice though you may be able to do this with a script. Have the script fire another process that hides itself from the task bar and pops into the screen at the designated time. I will think aboutthis. There might be a way to pull this off with a perl script. From: [EMAIL PROTECTED] [mailto: [EMAIL PROTECTED]] On Behalf Of Harding, DevonSent: Friday, October 07, 2005 4:46 PM To: ActiveDir@mail.activedir.orgSubject: RE: [ActiveDir] GPO Permissions with .vbs How would I use schtask to assign to more than one computer. It seems like that may be our only option. I can't believe its that difficult to get a popup of IE on ALL users desktop at a specific time. -Devon From: [EMAIL PROTECTED] [mailto: [EMAIL PROTECTED]] On Behalf Of Kamlesh ParmarSent: Friday, October 07, 2005 2:45 PMTo: ActiveDir@mail.activedir.org Subject: Re: [ActiveDir] GPO Permissions with .vbs This is specific to opening the internet explorer with higher privileges... (nothing to do with script runing at logon or startup) If I knew, that this scheduled job runs under Admin accountI can elevate my privileges to local admin, instantly, once the website is opened, I have to just type c:\ into address bar, (c:\ will open with FULL ACCESS) anyway, my actual point is, task will run as scheduled but the Internet explorer will never popup onto user's screenas it is running under LOCALSYSTEM account. you will need to schedule task which runs under normal user account, and AT.exe will not allow you to specify
Re: [ActiveDir] GPO Permissions with .vbs
Interactive doesn't help in LOCALSYSTEM context for GUI apps, only CMD.EXE canpop in LOCALSYSTEM context. I like to as far as possible, use the tools which come with os itself, so using Perl for this stuff might be overkill. Anyway, for scheduling it on many computers, 1) directly running schtasks.exe against list of computers, (I suggest this method if count is small) a) create normal domain user account, with complex password, for running the task. b)create a text file containing all the comps where you want to schedule the job. say, comps.txt c) put the following text into batch file, and save the batch file in same directory as comps.txt :: Start Copy Here @ECHO OFF for /F %%A in (comps.txt) do ( echo Scheduling the task on %%A ... schtasks /S %%A /create /SC WEEKLY /D MON,TUE,WED,THU,FRI /TN mypopup /TR C:\PROGRA~1\INTERN~1\iexplore.exe -new http://www.domain.com /ST 11:00 /IT /RU runuser /RP runpasswd /F) :: End Copy Here d) Make appropriate changes in the script above, for taskname(TN), username(RU), password(RP) now from your admin workstation, make sure you are logged in with user, who has admin rights over all the comps in question. Run the batch file, it will connect to each computer and schedule the task under specified user context. once, you verify that it is all scheduled, replace the actual username, password from batch file with dummies, and save it for future use. 2) If you want to use _vbscript_, coupled with GP deployment, then u will have to hide the credentials. As others suggested, many waysto do it, make actual app in VB, or use tools like CPAU from joeware, to encrypt the credential. (http://www.joeware.net/win/free/tools/cpau.htm) I use AutoIt from (http://www.autoitscript.com/autoit3/index.php) (damn cool replacement for VB apps for small tasks) If you choose to work with AutoIt, and get stuck, let me know... -- Kamlesh On 10/8/05, joe [EMAIL PROTECTED] wrote: Oh I just chased back through this thread... You want to fire up IE, I didn't catch that before, I didn't look that close at the specific process you wanted fire, just that you wanted to fire a process. You should still be able to do this with a startup script with AT as long as you specify interactive, it should pop in the current interactive session but I would be concerned of the security context it runs in which would be localsystem. In order to schedule something in the security context of another ID you will need to be able to specify userid/password which isn't fun either since someone will probably be able to see it if they are bright. What you want is something that opens an IE window in the context of the currentuser at a specified time. I am not aware of anything that will do that. You almostneed a special app that can be launched by the user in the logon script in their security context that will sleep until the specified time and then fire the app. Here is a point where being an admin with programming skills is nice though you may be able to do this with a script. Have the script fire another process that hides itself from the task bar and pops into the screen at the designated time. I will think aboutthis. There might be a way to pull this off with a perl script. From: [EMAIL PROTECTED] [mailto: [EMAIL PROTECTED]] On Behalf Of Harding, DevonSent: Friday, October 07, 2005 4:46 PM To: ActiveDir@mail.activedir.orgSubject: RE: [ActiveDir] GPO Permissions with .vbs How would I use schtask to assign to more than one computer. It seems like that may be our only option. I can't believe its that difficult to get a popup of IE on ALL users desktop at a specific time. -Devon From: [EMAIL PROTECTED] [mailto: [EMAIL PROTECTED]] On Behalf Of Kamlesh ParmarSent: Friday, October 07, 2005 2:45 PM To: ActiveDir@mail.activedir.orgSubject: Re: [ActiveDir] GPO Permissions with .vbs This is specific to opening the internet explorer with higher privileges... (nothing to do with script runing at logon or startup) If I knew, that this scheduled job runs under Admin accountI can elevate my privileges to local admin, instantly, once the website is opened, I have to just type c:\ into address bar, (c:\ will open with FULL ACCESS) anyway, my actual point is, task will run as scheduled but the Internet explorer will never popup onto user's screenas it is running under LOCALSYSTEM account. you will need to schedule task which runs under normal user account, and AT.exe will not allow you to specify the user account.You will have to create schedule task using schtasks.exe, where u can specify the normal user account under which to run the task. But gotcha is, you will have to provide the password for user under which u want task to run.e.g. schtasks /create /SC WEEKLY /D MON,TUE,WED,THU,FRI /TN myTaskName /TR C:\PROGRA~1\INTERN~1\iexplore.exe -new http://www.slashdot.org /ST 11:00 /IT /RU runuser /RP runpasswd /Fbut schtasks saves the day as you can schedule the task remotely onto
RE: [ActiveDir] GPO Permissions with .vbs
Interactive doesn't help in LOCALSYSTEM context for GUI apps, only CMD.EXE canpop in LOCALSYSTEM context. Not sure where you picked this up, but it is incorrect. I have been doing this for a loong time. Try this if you have SOON loaded soon 60 /interactive "C:\PROGRA~1\INTERN~1\iexplore.exe -new http://www.joeware.net" If not, just create the appropriate AT command. I just did it on an XP SP2 with all of the latest patches and within a minute I had an IE window up and running focused on my web site. However, just because it can be done, isn't a recommendation to do it. In fact, for this particular task, I would recommend against using the scheduler, it is added complexity that isn't needed. I like to as far as possible, use the tools which come with os itself, so using Perl for this stuff might be overkill. I like to think of overkill as when you go overboard to accomplish something simple. Eitherin terms of permissions or actions. Every method you list below messes with changing user context and IMO added complexity in a case where it isn't necessary. As for tools in the OS itself, the work done in my other post with the perl script coupled with quiet could be done in two_vbscript_ files. There is a WMI piece that will allow you to launch additional processes including hidden processes. It willjust be longer than what I put in that post. For instance the the string comparison I did for the current to desired date would need to be done a different way or would probably take considerably more _vbscript_. But the fun thing is that for such a simple script as that (and actually even much more complex scripts), you only need two files from the perl distribution, perl.exe and perl58.dll (for the current dist, older dists may need a different dll). Both of which could be in the same folder where you have the script and quiet.exe. I have had very complex share/printer reconnection perl scripts and software delivery scripts running as logon scripts for thousands of users where perl is never loaded on the clients, the two binaries are simply in the netlogon share. I havealso had entire server build scripts done this way that take a server from nothing to fully loaded with all apps and tools in place.As long as you aren't using modules you have to import you are fine and it is very rare I use modules for that exact reason. Further, running a batch file from one machine against others for this would be simple only for a small number of machines, probably such a small amount that you could just stand up and yell across the room what people should do. As you start to scale you need far more error checking, is the machine up? Is the scheduler even running? Did the job schedule properly? All of those then require either error reporting or a loop back to hit them again. Plus it would just be plain slow unless you MTed it which you won't be doing from BAT very soon. All added complexity. joe From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Kamlesh ParmarSent: Saturday, October 08, 2005 5:58 AMTo: ActiveDir@mail.activedir.orgSubject: Re: [ActiveDir] GPO Permissions with .vbs Interactive doesn't help in LOCALSYSTEM context for GUI apps, only CMD.EXE canpop in LOCALSYSTEM context. I like to as far as possible, use the tools which come with os itself, so using Perl for this stuff might be overkill. Anyway, for scheduling it on many computers, 1) directly running schtasks.exe against list of computers, (I suggest this method if count is small) a) create normal domain user account, with complex password, for running the task. b)create a text file containing all the comps where you want to schedule the job. say, comps.txt c) put the following text into batch file, and save the batch file in same directory as comps.txt :: Start Copy Here @ECHO OFF for /F %%A in (comps.txt) do ( echo Scheduling the task on %%A ... schtasks /S %%A /create /SC WEEKLY /D MON,TUE,WED,THU,FRI /TN mypopup /TR "C:\PROGRA~1\INTERN~1\iexplore.exe -new http://www.domain.com" /ST 11:00 /IT /RU runuser /RP runpasswd /F) :: End Copy Here d) Make appropriate changes in the script above, for taskname(TN), username(RU), password(RP) now from your admin workstation, make sure you are logged in with user, who has admin rights over all the comps in question. Run the batch file, it will connect to each computer and schedule the task under specified user context. once, you verify that it is all scheduled, replace the actual username, password from batch file with dummies, and save it for future use. 2) If you want to use _vbscript_, coupled with GP deployment, then u will have to hide the credentials. As others suggested, many waysto do it, make actual app in VB, or use tools like CPAU from joeware, to encrypt the credential. (http://www.joeware.net/win/free/tools/cpau.htm) I use AutoIt from (http://www.autoitscript.c
Re: [ActiveDir] GPO Permissions with .vbs
At.exe will always reqire admin rights, but normal user account can always schedule task using, Task Scheduler.. So use command line utility schtasks.exe, it should be present on all XP box, don't know about win2K.. just see the help... schtasks.exe /create /? On 10/6/05, Harding, Devon [EMAIL PROTECTED] wrote: The problem is the at.exe command can only be run by administrators. How can I allow non-admins to run at.exe therefore allowing my script to work. From: [EMAIL PROTECTED] [mailto: [EMAIL PROTECTED]] On Behalf Of Tim Vander KooiSent: Wednesday, October 05, 2005 6:01 PM To: ActiveDir@mail.activedir.orgSubject: RE: [ActiveDir] GPO Permissions with .vbs What is your OS? Is it a user specific task or a computer based task? If it is a task scheduled to run after the user logs on I'm sure it is permissions, or lack there of. Tim Vander Kooi Microsoft Systems Administrator Explorer Pipeline From: [EMAIL PROTECTED] [mailto: [EMAIL PROTECTED]] On Behalf Of Harding, DevonSent: Wednesday, October 05, 2005 3:56 PMTo: ActiveDir@mail.activedir.orgSubject: [ActiveDir] GPO Permissions with .vbs I created a GPO for all Domain Users to run a .vbs script to create a Scheduled Task. It works with Domain Admins, but not with regular users. How can I fix this? Devon Harding Windows Systems Engineer Southern Wine Spirits - BSG 954-602-2469 __ This message and any attachments are solely for the intended recipientand may contain confidential or privileged information. If you are not the intended recipient, any disclosure, copying, use or distribution ofthe information included in the message and any attachments is prohibited. If you have received this communication in error, pleasenotify us by reply e-mail and immediately and permanently delete this message and any attachments. Thank You. -- ~~~ Fortune and Love befriend the bold~~~
RE: [ActiveDir] GPO Permissions with .vbs
Well it didnt work.heres
the script:
strComputer = .
strNewCmd = C:\PROGRA~1\INTERN~1\iexplore.exe -new
http://www.domain.com
Set objWMIService =
GetObject(winmgmts:{impersonationLevel=impersonate}!\\
strComputer \root\cimv2)
Set colScheduledTasks = objWMIService.ExecQuery(Select
* from Win32_ScheduledJob)
For Each objTask in colScheduledTasks
intJobID = objTask.JobID
strCurCmd = objTask.Command
If strCurCmd = strNewCmd Then
Set objInstance =
objWMIService.Get(Win32_ScheduledJob.JobID= intJobID)
objInstance.Delete
End If
Next
Set objNewJob =
objWMIService.Get(Win32_ScheduledJob)
errJobCreated = objNewJob.Create (strNewCmd,
11.00-240, True , 1 OR 2 OR 4 OR 8 OR 16, , ,
JobID)
From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of joe
Sent: Thursday, October 06, 2005
9:01 PM
To: ActiveDir@mail.activedir.org
Subject: RE: [ActiveDir] GPO
Permissions with .vbs
I can't visualize why it
shouldn't work.
From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Harding,
Devon
Sent: Thursday, October 06, 2005
2:14 PM
To: ActiveDir@mail.activedir.org
Subject: RE: [ActiveDir] GPO
Permissions with .vbs
Itll only schedule
tasks on logon scripts, not startup. Someone correct me if Im
wrong.
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On
Behalf Of Rich Milburn
Sent: Thursday, October 06, 2005
11:41 AM
To: ActiveDir@mail.activedir.org
Subject: RE: [ActiveDir] GPO
Permissions with .vbs
Can you
set it to be a startup script instead of a logon script (computer configuration
software section of GPO instead of user configuration software
section) then it will run with privs, not as the non-admin.
---
Rich Milburn
MCSE, Microsoft MVP -
Directory Services
Sr Network Analyst, Field
Platform Development
Applebee's International,
Inc.
4551 W. 107th St
Overland Park, KS 66207
913-967-2819
---
I am always doing
that which I can not do, in order that I may learn how to do it. - Pablo
Picasso
From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Harding,
Devon
Sent: Thursday, October 06, 2005
9:48 AM
To: ActiveDir@mail.activedir.org
Subject: RE: [ActiveDir] GPO
Permissions with .vbs
The
problem is the at.exe command can only be run by administrators. How can
I allow non-admins to run at.exe therefore allowing my script to work.
From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Tim Vander Kooi
Sent: Wednesday, October 05, 2005
6:01 PM
To: ActiveDir@mail.activedir.org
Subject: RE: [ActiveDir] GPO
Permissions with .vbs
What is
your OS? Is it a user specific task or a computer based task? If it is a task
scheduled to run after the user logs on I'm sure it is permissions, or lack
there of.
Tim
Vander Kooi
Microsoft
Systems Administrator
Explorer
Pipeline
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On
Behalf Of Harding, Devon
Sent: Wednesday, October 05, 2005
3:56 PM
To: ActiveDir@mail.activedir.org
Subject: [ActiveDir] GPO
Permissions with .vbs
I created a GPO for all Domain Users
to run a .vbs script to create a Scheduled Task. It works with Domain
Admins, but not with regular users. How can I fix this?
Devon Harding
Windows
Systems Engineer
Southern
Wine Spirits - BSG
954-602-2469
__
This message and any attachments are
solely for the intended recipient
and may contain confidential or
privileged information. If you are not
the intended recipient, any disclosure,
copying, use or distribution of
the information included in the message
and any attachments is
prohibited. If you have received this
communication in error, please
notify us by reply e-mail and
immediately and permanently delete this
message and any attachments. Thank You.
---APPLEBEE'S
INTERNATIONAL, INC. CONFIDENTIALITY NOTICE---
PRIVILEGED /
CONFIDENTIAL INFORMATION may be contained in this message or any attachments.
This information is strictly confidential and may be subject to attorney-client
privilege. This message is intended only for the use of the named addressee. If
you are not the intended recipient of this message, unauthorized forwarding,
printing, copying, distribution, or using such information is strictly
prohibited and may be unlawful. If you have received this in error, you should
kindly notify the sender by reply e-mail and immediately destroy this message.
Unauthorized interception of this e-mail is a violation of federal criminal
law. Applebee's International, Inc. reserves the right to monitor and review
the content of all messages sent to and from this e-mail address. Messages sent
to or from this e-mail address may be stored on the Applebee's International,
Inc. e-mail system.
RE: [ActiveDir] GPO Permissions with .vbs
Error messages? Do you get anything? Do you know for sure
the script is running?
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Harding,
DevonSent: Friday, October 07, 2005 9:28 AMTo:
ActiveDir@mail.activedir.orgSubject: RE: [ActiveDir] GPO Permissions
with .vbs
Well it didnt
work.heres the script:
strComputer
= "."
strNewCmd
= "C:\PROGRA~1\INTERN~1\iexplore.exe -new
http://www.domain.com"
Set
objWMIService =
GetObject("winmgmts:{impersonationLevel=impersonate}!\\" strComputer
"\root\cimv2")
Set
colScheduledTasks
=
objWMIService.ExecQuery("Select * from
Win32_ScheduledJob")
For
Each objTask in colScheduledTasks
intJobID = objTask.JobID
strCurCmd = objTask.Command
If strCurCmd = strNewCmd Then
Set objInstance =
objWMIService.Get("Win32_ScheduledJob.JobID="
intJobID)
objInstance.Delete
End If
Next
Set
objNewJob =
objWMIService.Get("Win32_ScheduledJob")
errJobCreated
= objNewJob.Create (strNewCmd, "11.00-240", True , 1 OR 2 OR 4
OR 8 OR 16, , , JobID)
From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]
On Behalf Of joeSent: Thursday, October 06, 2005 9:01
PMTo: ActiveDir@mail.activedir.orgSubject: RE: [ActiveDir] GPO Permissions
with .vbs
I can't
visualize why it shouldn't work.
From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]
On Behalf Of Harding, DevonSent: Thursday, October 06, 2005 2:14
PMTo: ActiveDir@mail.activedir.orgSubject: RE: [ActiveDir] GPO Permissions
with .vbs
Itll only
schedule tasks on logon scripts, not startup. Someone correct me if Im
wrong.
From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]
On Behalf Of Rich
MilburnSent: Thursday, October
06, 2005 11:41 AMTo:
ActiveDir@mail.activedir.orgSubject: RE: [ActiveDir] GPO Permissions
with .vbs
Can you
set it to be a startup script instead of a logon script (computer configuration
software section of GPO instead of user configuration software
section) then it will run with privs, not as the
non-admin.
---Rich
MilburnMCSE, Microsoft MVP -
Directory ServicesSr
Network Analyst, Field Platform DevelopmentApplebee's
International, Inc.4551
W. 107th
StOverland
Park,
KS 66207913-967-2819---"I am always doing
that which I can not do, in order that I may learn how to do it." - Pablo
Picasso
From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]
On Behalf Of Harding, DevonSent: Thursday, October 06, 2005 9:48
AMTo: ActiveDir@mail.activedir.orgSubject: RE: [ActiveDir] GPO Permissions
with .vbs
The
problem is the at.exe command can only be run by administrators. How can I
allow non-admins to run at.exe therefore allowing my script to
work.
From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]
On Behalf Of Tim Vander
KooiSent: Wednesday, October
05, 2005 6:01 PMTo:
ActiveDir@mail.activedir.orgSubject: RE: [ActiveDir] GPO Permissions
with .vbs
What is
your OS? Is it a user specific task or a computer based task? If it is a task
scheduled to run after the user logs on I'm sure it is permissions, or lack
there of.
Tim Vander
Kooi
Microsoft
Systems Administrator
Explorer
Pipeline
From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]
On Behalf Of Harding, DevonSent: Wednesday, October 05, 2005 3:56
PMTo: ActiveDir@mail.activedir.orgSubject: [ActiveDir] GPO Permissions with
.vbs
I created a GPO for all Domain Users
to run a .vbs script to create a Scheduled Task. It works with Domain
Admins, but not with regular users. How can I fix
this?
Devon
Harding
Windows
Systems Engineer
Southern Wine
Spirits - BSG
954-602-2469
__This
message and any attachments are solely for the intended
recipientand may
contain confidential or privileged information. If you are
notthe intended
recipient, any disclosure, copying, use or distribution
ofthe
information included in the message and any attachments
isprohibited. If
you have received this communication in error,
pleasenotify us
by reply e-mail and immediately and permanently delete
thismessage and
any attachments. Thank You.
---APPLEBEE'S
INTERNATIONAL, INC. CONFIDENTIALITY
NOTICE--- PRIVILEGED / CONFIDENTIAL
INFORMATION may be contained in this message or any attachments. This
information is strictly confidential and may be subject to attorney-client
privilege. This message is intended only for the use of the named addressee. If
you are not the intended recipient of this message, unauthorized forwarding,
printing, copying, distribution, or using such information is strictly
prohibited and may be unlawful. If you have received this in error, you should
kindly notify the sender by reply e-mail and immediately destroy this message.
Unauthorized int
RE: [ActiveDir] GPO Permissions with .vbs
If I put this in the Logon Scripts, it
runs but just for local administrators. I need this to run for ALL users.
From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of joe
Sent: Friday, October 07, 2005
11:08 AM
To: ActiveDir@mail.activedir.org
Subject: RE: [ActiveDir] GPO
Permissions with .vbs
Error messages? Do you
get anything? Do you know for sure the script is running?
From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Harding,
Devon
Sent: Friday, October 07, 2005
9:28 AM
To: ActiveDir@mail.activedir.org
Subject: RE: [ActiveDir] GPO
Permissions with .vbs
Well it didnt
work.heres the script:
strComputer = .
strNewCmd = C:\PROGRA~1\INTERN~1\iexplore.exe
-new http://www.domain.com
Set objWMIService =
GetObject(winmgmts:{impersonationLevel=impersonate}!\\
strComputer \root\cimv2)
Set colScheduledTasks
=
objWMIService.ExecQuery(Select * from Win32_ScheduledJob)
For Each objTask in colScheduledTasks
intJobID = objTask.JobID
strCurCmd = objTask.Command
If strCurCmd = strNewCmd Then
Set objInstance =
objWMIService.Get(Win32_ScheduledJob.JobID= intJobID)
objInstance.Delete
End If
Next
Set objNewJob =
objWMIService.Get(Win32_ScheduledJob)
errJobCreated = objNewJob.Create (strNewCmd,
11.00-240, True , 1 OR 2 OR 4 OR 8 OR 16, , ,
JobID)
From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of joe
Sent: Thursday, October 06, 2005
9:01 PM
To: ActiveDir@mail.activedir.org
Subject: RE: [ActiveDir] GPO
Permissions with .vbs
I can't
visualize why it shouldn't work.
From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Harding,
Devon
Sent: Thursday, October 06, 2005
2:14 PM
To: ActiveDir@mail.activedir.org
Subject: RE: [ActiveDir] GPO
Permissions with .vbs
Itll
only schedule tasks on logon scripts, not startup. Someone correct me if
Im wrong.
From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Rich Milburn
Sent: Thursday, October 06, 2005
11:41 AM
To: ActiveDir@mail.activedir.org
Subject: RE: [ActiveDir] GPO
Permissions with .vbs
Can you
set it to be a startup script instead of a logon script (computer configuration
software section of GPO instead of user configuration software
section) then it will run with privs, not as the non-admin.
---
Rich Milburn
MCSE, Microsoft MVP -
Directory Services
Sr Network Analyst, Field
Platform Development
Applebee's International,
Inc.
4551 W. 107th St
Overland Park, KS 66207
913-967-2819
---
I am always doing
that which I can not do, in order that I may learn how to do it. - Pablo
Picasso
From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Harding,
Devon
Sent: Thursday, October 06, 2005
9:48 AM
To: ActiveDir@mail.activedir.org
Subject: RE: [ActiveDir] GPO
Permissions with .vbs
The
problem is the at.exe command can only be run by administrators. How can
I allow non-admins to run at.exe therefore allowing my script to work.
From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Tim Vander Kooi
Sent: Wednesday, October 05, 2005
6:01 PM
To: ActiveDir@mail.activedir.org
Subject: RE: [ActiveDir] GPO
Permissions with .vbs
What is
your OS? Is it a user specific task or a computer based task? If it is a task
scheduled to run after the user logs on I'm sure it is permissions, or lack
there of.
Tim
Vander Kooi
Microsoft
Systems Administrator
Explorer
Pipeline
From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Harding,
Devon
Sent: Wednesday, October 05, 2005
3:56 PM
To: ActiveDir@mail.activedir.org
Subject: [ActiveDir] GPO Permissions
with .vbs
I created a GPO for all Domain Users
to run a .vbs script to create a Scheduled Task. It works with Domain
Admins, but not with regular users. How can I fix this?
Devon Harding
Windows
Systems Engineer
Southern
Wine Spirits - BSG
954-602-2469
__
This message and any attachments are
solely for the intended recipient
and may contain confidential or
privileged information. If you are not
the intended recipient, any disclosure,
copying, use or distribution of
the information included in the message
and any attachments is
prohibited. If you have received this
communication in error, please
notify us by reply e-mail and
immediately and permanently delete this
message and any attachments. Thank You.
---APPLEBEE'S
INTERNATIONAL, INC. CONFIDENTIALITY NOTICE---
PRIVILEGED /
CONFIDENTIAL INFORMATION may be contained in this message or any attachments.
This information is strictly confidential and may be subject to attorney-client
privilege. This message is intended only for the use of the named addressee. If
you
RE: [ActiveDir] GPO Permissions with .vbs
Is it running interactively first?
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of
joeSent: Friday, October 07, 2005 8:08 AMTo:
ActiveDir@mail.activedir.orgSubject: RE: [ActiveDir] GPO Permissions
with .vbs
Error messages? Do you get anything? Do you know for sure
the script is running?
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Harding,
DevonSent: Friday, October 07, 2005 9:28 AMTo:
ActiveDir@mail.activedir.orgSubject: RE: [ActiveDir] GPO Permissions
with .vbs
Well it didnt
work.heres the script:
strComputer
= "."
strNewCmd
= "C:\PROGRA~1\INTERN~1\iexplore.exe -new
http://www.domain.com"
Set
objWMIService =
GetObject("winmgmts:{impersonationLevel=impersonate}!\\" strComputer
"\root\cimv2")
Set
colScheduledTasks
=
objWMIService.ExecQuery("Select * from
Win32_ScheduledJob")
For
Each objTask in colScheduledTasks
intJobID = objTask.JobID
strCurCmd = objTask.Command
If strCurCmd = strNewCmd Then
Set objInstance =
objWMIService.Get("Win32_ScheduledJob.JobID="
intJobID)
objInstance.Delete
End If
Next
Set
objNewJob =
objWMIService.Get("Win32_ScheduledJob")
errJobCreated
= objNewJob.Create (strNewCmd, "11.00-240", True , 1 OR 2 OR 4
OR 8 OR 16, , , JobID)
From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]
On Behalf Of joeSent: Thursday, October 06, 2005 9:01
PMTo: ActiveDir@mail.activedir.orgSubject: RE: [ActiveDir] GPO Permissions
with .vbs
I can't
visualize why it shouldn't work.
From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]
On Behalf Of Harding, DevonSent: Thursday, October 06, 2005 2:14
PMTo: ActiveDir@mail.activedir.orgSubject: RE: [ActiveDir] GPO Permissions
with .vbs
Itll only
schedule tasks on logon scripts, not startup. Someone correct me if Im
wrong.
From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]
On Behalf Of Rich
MilburnSent: Thursday, October
06, 2005 11:41 AMTo:
ActiveDir@mail.activedir.orgSubject: RE: [ActiveDir] GPO Permissions
with .vbs
Can you
set it to be a startup script instead of a logon script (computer configuration
software section of GPO instead of user configuration software
section) then it will run with privs, not as the
non-admin.
---Rich
MilburnMCSE, Microsoft MVP -
Directory ServicesSr
Network Analyst, Field Platform DevelopmentApplebee's
International, Inc.4551
W. 107th
StOverland
Park,
KS 66207913-967-2819---"I am always doing
that which I can not do, in order that I may learn how to do it." - Pablo
Picasso
From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]
On Behalf Of Harding, DevonSent: Thursday, October 06, 2005 9:48
AMTo: ActiveDir@mail.activedir.orgSubject: RE: [ActiveDir] GPO Permissions
with .vbs
The
problem is the at.exe command can only be run by administrators. How can I
allow non-admins to run at.exe therefore allowing my script to
work.
From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]
On Behalf Of Tim Vander
KooiSent: Wednesday, October
05, 2005 6:01 PMTo:
ActiveDir@mail.activedir.orgSubject: RE: [ActiveDir] GPO Permissions
with .vbs
What is
your OS? Is it a user specific task or a computer based task? If it is a task
scheduled to run after the user logs on I'm sure it is permissions, or lack
there of.
Tim Vander
Kooi
Microsoft
Systems Administrator
Explorer
Pipeline
From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]
On Behalf Of Harding, DevonSent: Wednesday, October 05, 2005 3:56
PMTo: ActiveDir@mail.activedir.orgSubject: [ActiveDir] GPO Permissions with
.vbs
I created a GPO for all Domain Users
to run a .vbs script to create a Scheduled Task. It works with Domain
Admins, but not with regular users. How can I fix
this?
Devon
Harding
Windows
Systems Engineer
Southern Wine
Spirits - BSG
954-602-2469
__This
message and any attachments are solely for the intended
recipientand may
contain confidential or privileged information. If you are
notthe intended
recipient, any disclosure, copying, use or distribution
ofthe
information included in the message and any attachments
isprohibited. If
you have received this communication in error,
pleasenotify us
by reply e-mail and immediately and permanently delete
thismessage and
any attachments. Thank You.
---APPLEBEE'S
INTERNATIONAL, INC. CONFIDENTIALITY
NOTICE--- PRIVILEGED / CONFIDENTIAL
INFORMATION may be contained in this message or any attachments. This
information is strictly confidential and may be subject to attorney-client
privilege. This message is intended only for the use of the named addressee. If
you are not the intended recipient of this message, unauthorized forwarding,
printing, copying, d
RE: [ActiveDir] GPO Permissions with .vbs
I tested AT from a batch file in the startup script, it scheduled fine AT 12:30 notepad.exe Created a job. I did not try it from a vbs Rich --- Rich Milburn MCSE, Microsoft MVP - Directory Services Sr Network Analyst, Field Platform Development Applebee's International, Inc. 4551 W. 107th St Overland Park, KS 66207 913-967-2819 --- I am always doing that which I can not do, in order that I may learn how to do it. - Pablo Picasso From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Kamlesh Parmar Sent: Friday, October 07, 2005 2:00 AM To: ActiveDir@mail.activedir.org Subject: Re: [ActiveDir] GPO Permissions with .vbs At.exe will always reqire admin rights, but normal user account can always schedule task using, Task Scheduler.. So use command line utility schtasks.exe, it should be present on all XP box, don't know about win2K.. just see the help... schtasks.exe /create /? On 10/6/05, Harding, Devon [EMAIL PROTECTED] wrote: The problem is the at.exe command can only be run by administrators. How can I allow non-admins to run at.exe therefore allowing my script to work. From: [EMAIL PROTECTED] [mailto: [EMAIL PROTECTED]] On Behalf Of Tim Vander Kooi Sent: Wednesday, October 05, 2005 6:01 PM To: ActiveDir@mail.activedir.org Subject: RE: [ActiveDir] GPO Permissions with .vbs What is your OS? Is it a user specific task or a computer based task? If it is a task scheduled to run after the user logs on I'm sure it is permissions, or lack there of. Tim Vander Kooi Microsoft Systems Administrator Explorer Pipeline From: [EMAIL PROTECTED] [mailto: [EMAIL PROTECTED]] On Behalf Of Harding, Devon Sent: Wednesday, October 05, 2005 3:56 PM To: ActiveDir@mail.activedir.org Subject: [ActiveDir] GPO Permissions with .vbs I created a GPO for all Domain Users to run a .vbs script to create a Scheduled Task. It works with Domain Admins, but not with regular users. How can I fix this? Devon Harding Windows Systems Engineer Southern Wine Spirits - BSG 954-602-2469 __ This message and any attachments are solely for the intended recipient and may contain confidential or privileged information. If you are not the intended recipient, any disclosure, copying, use or distribution of the information included in the message and any attachments is prohibited. If you have received this communication in error, please notify us by reply e-mail and immediately and permanently delete this message and any attachments. Thank You. -- ~~~ Fortune and Love befriend the bold ~~~ ---APPLEBEE'S INTERNATIONAL, INC. CONFIDENTIALITY NOTICE--- PRIVILEGED / CONFIDENTIAL INFORMATION may be contained in this message or any attachments. This information is strictly confidential and may be subject to attorney-client privilege. This message is intended only for the use of the named addressee. If you are not the intended recipient of this message, unauthorized forwarding, printing, copying, distribution, or using such information is strictly prohibited and may be unlawful. If you have received this in error, you should kindly notify the sender by reply e-mail and immediately destroy this message. Unauthorized interception of this e-mail is a violation of federal criminal law. Applebee's International, Inc. reserves the right to monitor and review the content of all messages sent to and from this e-mail address. Messages sent to or from this e-mail address may be stored on the Applebee's International, Inc. e-mail system.
RE: [ActiveDir] GPO Permissions with .vbs
Yeah, we were talking startup scripts though. You aren't
going to get it to run for non-admins unless you use something that elevates the
permissions temporarily to run it. Startup scripts should run it fine though
because they run as localsystem. So what are the issues you see with running it
as a startup script?
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Harding,
DevonSent: Friday, October 07, 2005 11:28 AMTo:
ActiveDir@mail.activedir.orgSubject: RE: [ActiveDir] GPO Permissions
with .vbs
If I put this in the
Logon Scripts, it runs but just for local administrators. I need this to
run for ALL users.
From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]
On Behalf Of joeSent: Friday, October 07, 2005 11:08
AMTo: ActiveDir@mail.activedir.orgSubject: RE: [ActiveDir] GPO Permissions
with .vbs
Error
messages? Do you get anything? Do you know for sure the script is
running?
From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]
On Behalf Of Harding, DevonSent: Friday, October 07, 2005 9:28
AMTo: ActiveDir@mail.activedir.orgSubject: RE: [ActiveDir] GPO Permissions
with .vbs
Well it
didnt work.heres the script:
strComputer
= "."
strNewCmd
= "C:\PROGRA~1\INTERN~1\iexplore.exe -new
http://www.domain.com"
Set
objWMIService =
GetObject("winmgmts:{impersonationLevel=impersonate}!\\" strComputer
"\root\cimv2")
Set
colScheduledTasks
=
objWMIService.ExecQuery("Select * from
Win32_ScheduledJob")
For
Each objTask in colScheduledTasks
intJobID = objTask.JobID
strCurCmd = objTask.Command
If strCurCmd = strNewCmd Then
Set objInstance =
objWMIService.Get("Win32_ScheduledJob.JobID="
intJobID)
objInstance.Delete
End If
Next
Set
objNewJob =
objWMIService.Get("Win32_ScheduledJob")
errJobCreated
= objNewJob.Create (strNewCmd, "11.00-240", True , 1 OR 2 OR 4
OR 8 OR 16, , , JobID)
From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]
On Behalf Of joeSent: Thursday, October 06, 2005 9:01
PMTo: ActiveDir@mail.activedir.orgSubject: RE: [ActiveDir] GPO Permissions
with .vbs
I can't
visualize why it shouldn't work.
From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]
On Behalf Of Harding, DevonSent: Thursday, October 06, 2005 2:14
PMTo: ActiveDir@mail.activedir.orgSubject: RE: [ActiveDir] GPO Permissions
with .vbs
Itll only
schedule tasks on logon scripts, not startup. Someone correct me if Im
wrong.
From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]
On Behalf Of Rich
MilburnSent: Thursday, October
06, 2005 11:41 AMTo:
ActiveDir@mail.activedir.orgSubject: RE: [ActiveDir] GPO Permissions
with .vbs
Can you
set it to be a startup script instead of a logon script (computer configuration
software section of GPO instead of user configuration software
section) then it will run with privs, not as the
non-admin.
---Rich
MilburnMCSE, Microsoft MVP -
Directory ServicesSr
Network Analyst, Field Platform DevelopmentApplebee's
International, Inc.4551
W. 107th
StOverland
Park,
KS 66207913-967-2819---"I am always doing
that which I can not do, in order that I may learn how to do it." - Pablo
Picasso
From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]
On Behalf Of Harding, DevonSent: Thursday, October 06, 2005 9:48
AMTo: ActiveDir@mail.activedir.orgSubject: RE: [ActiveDir] GPO Permissions
with .vbs
The
problem is the at.exe command can only be run by administrators. How can I
allow non-admins to run at.exe therefore allowing my script to
work.
From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]
On Behalf Of Tim Vander
KooiSent: Wednesday, October
05, 2005 6:01 PMTo:
ActiveDir@mail.activedir.orgSubject: RE: [ActiveDir] GPO Permissions
with .vbs
What is
your OS? Is it a user specific task or a computer based task? If it is a task
scheduled to run after the user logs on I'm sure it is permissions, or lack
there of.
Tim Vander
Kooi
Microsoft
Systems Administrator
Explorer
Pipeline
From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]
On Behalf Of Harding, DevonSent: Wednesday, October 05, 2005 3:56
PMTo: ActiveDir@mail.activedir.orgSubject: [ActiveDir] GPO Permissions with
.vbs
I created a GPO for all Domain Users
to run a .vbs script to create a Scheduled Task. It works with Domain
Admins, but not with regular users. How can I fix
this?
Devon
Harding
Windows
Systems Engineer
Southern Wine
Spirits - BSG
954-602-2469
__This
message and any attachments are solely for the intended
recipientand may
contain confidential or privileged information. If you are
notthe intended
recipient, any disclosure, copying, use or distribution
ofthe
information included in the message and any atta
RE: [ActiveDir] GPO Permissions with .vbs
I tested several scenarios:
1) batch file in startup
script in GPO with non-privileged user logging on job appeared in AT.
2) Your script in startup
script in GPO with non-privileged user logging on job appeared in AT.
3) Your script in logon
script in GPO with non-privileged user logging on job did not appear in AT.
So I verified your results that this does
not work from a logon script with
a non-privileged user, and I verified that the same script can schedule jobs on the computer from a startup script.
Hope that helps
Rich
---
Rich Milburn
MCSE, Microsoft MVP -
Directory Services
Sr Network Analyst, Field
Platform Development
Applebee's International,
Inc.
4551 W. 107th St
Overland Park, KS 66207
913-967-2819
---
I am always doing
that which I can not do, in order that I may learn how to do it. - Pablo
Picasso
From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Harding, Devon
Sent: Friday, October 07, 2005
10:28 AM
To: ActiveDir@mail.activedir.org
Subject: RE: [ActiveDir] GPO
Permissions with .vbs
If I put this in the Logon Scripts, it
runs but just for local administrators. I need this to run for ALL users.
From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of joe
Sent: Friday, October 07, 2005 11:08
AM
To: ActiveDir@mail.activedir.org
Subject: RE: [ActiveDir] GPO
Permissions with .vbs
Error messages? Do you
get anything? Do you know for sure the script is running?
From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Harding,
Devon
Sent: Friday, October 07, 2005
9:28 AM
To: ActiveDir@mail.activedir.org
Subject: RE: [ActiveDir] GPO
Permissions with .vbs
Well it didnt
work.heres the script:
strComputer = .
strNewCmd = C:\PROGRA~1\INTERN~1\iexplore.exe
-new http://www.domain.com
Set objWMIService =
GetObject(winmgmts:{impersonationLevel=impersonate}!\\
strComputer \root\cimv2)
Set colScheduledTasks
=
objWMIService.ExecQuery(Select * from Win32_ScheduledJob)
For Each objTask in colScheduledTasks
intJobID = objTask.JobID
strCurCmd = objTask.Command
If strCurCmd = strNewCmd Then
Set objInstance =
objWMIService.Get(Win32_ScheduledJob.JobID= intJobID)
objInstance.Delete
End If
Next
Set objNewJob =
objWMIService.Get(Win32_ScheduledJob)
errJobCreated = objNewJob.Create (strNewCmd,
11.00-240, True , 1 OR 2 OR 4 OR 8 OR 16, , ,
JobID)
From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of joe
Sent: Thursday, October 06, 2005
9:01 PM
To: ActiveDir@mail.activedir.org
Subject: RE: [ActiveDir] GPO
Permissions with .vbs
I can't
visualize why it shouldn't work.
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On
Behalf Of Harding, Devon
Sent: Thursday, October 06, 2005
2:14 PM
To: ActiveDir@mail.activedir.org
Subject: RE: [ActiveDir] GPO
Permissions with .vbs
Itll
only schedule tasks on logon scripts, not startup. Someone correct me if
Im wrong.
From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Rich Milburn
Sent: Thursday, October 06, 2005
11:41 AM
To: ActiveDir@mail.activedir.org
Subject: RE: [ActiveDir] GPO
Permissions with .vbs
Can you
set it to be a startup script instead of a logon script (computer configuration
software section of GPO instead of user configuration software
section) then it will run with privs, not as the non-admin.
---
Rich Milburn
MCSE, Microsoft MVP -
Directory Services
Sr Network Analyst, Field
Platform Development
Applebee's International,
Inc.
4551 W. 107th St
Overland Park, KS 66207
913-967-2819
---
I am always doing
that which I can not do, in order that I may learn how to do it. - Pablo
Picasso
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On
Behalf Of Harding, Devon
Sent: Thursday, October 06, 2005
9:48 AM
To: ActiveDir@mail.activedir.org
Subject: RE: [ActiveDir] GPO
Permissions with .vbs
The
problem is the at.exe command can only be run by administrators. How can
I allow non-admins to run at.exe therefore allowing my script to work.
From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Tim Vander Kooi
Sent: Wednesday, October 05, 2005
6:01 PM
To: ActiveDir@mail.activedir.org
Subject: RE: [ActiveDir] GPO
Permissions with .vbs
What is
your OS? Is it a user specific task or a computer based task? If it is a task
scheduled to run after the user logs on I'm sure it is permissions, or lack
there of.
Tim
Vander Kooi
Microsoft
Systems Administrator
Explorer
Pipeline
From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Harding
RE: [ActiveDir] GPO Permissions with .vbs
Since this is a startup script, is it safe
to say I can use only the Domain Computers for applying or do I
need to add the user as well?
From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Rich Milburn
Sent: Friday, October 07, 2005
12:11 PM
To: ActiveDir@mail.activedir.org
Subject: RE: [ActiveDir] GPO
Permissions with .vbs
I tested several
scenarios:
1) batch file in startup
script in GPO with non-privileged user logging on job appeared in AT.
2) Your script in startup
script in GPO with non-privileged user logging on job appeared in AT.
3) Your script in logon
script in GPO with non-privileged user logging on job did not appear in AT.
So I verified your
results that this does not work from a logon
script with a non-privileged user, and I verified that the same script can schedule jobs on the computer from a startup script.
Hope that helps
Rich
---
Rich Milburn
MCSE, Microsoft MVP -
Directory Services
Sr Network Analyst, Field
Platform Development
Applebee's International,
Inc.
4551 W. 107th St
Overland Park, KS 66207
913-967-2819
---
I am always doing
that which I can not do, in order that I may learn how to do it. - Pablo
Picasso
From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Harding,
Devon
Sent: Friday, October 07, 2005
10:28 AM
To: ActiveDir@mail.activedir.org
Subject: RE: [ActiveDir] GPO
Permissions with .vbs
If I put this in the
Logon Scripts, it runs but just for local administrators. I need this to
run for ALL users.
From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of joe
Sent: Friday, October 07, 2005
11:08 AM
To: ActiveDir@mail.activedir.org
Subject: RE: [ActiveDir] GPO
Permissions with .vbs
Error
messages? Do you get anything? Do you know for sure the script is running?
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On
Behalf Of Harding, Devon
Sent: Friday, October 07, 2005
9:28 AM
To: ActiveDir@mail.activedir.org
Subject: RE: [ActiveDir] GPO
Permissions with .vbs
Well it
didnt work.heres the script:
strComputer = .
strNewCmd = C:\PROGRA~1\INTERN~1\iexplore.exe
-new http://www.domain.com
Set objWMIService =
GetObject(winmgmts:{impersonationLevel=impersonate}!\\
strComputer \root\cimv2)
Set colScheduledTasks
=
objWMIService.ExecQuery(Select * from Win32_ScheduledJob)
For Each objTask in colScheduledTasks
intJobID = objTask.JobID
strCurCmd = objTask.Command
If strCurCmd = strNewCmd Then
Set objInstance =
objWMIService.Get(Win32_ScheduledJob.JobID= intJobID)
objInstance.Delete
End If
Next
Set objNewJob =
objWMIService.Get(Win32_ScheduledJob)
errJobCreated = objNewJob.Create (strNewCmd,
11.00-240, True , 1 OR 2 OR 4 OR 8 OR 16, , ,
JobID)
From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of joe
Sent: Thursday, October 06, 2005
9:01 PM
To: ActiveDir@mail.activedir.org
Subject: RE: [ActiveDir] GPO
Permissions with .vbs
I can't
visualize why it shouldn't work.
From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Harding,
Devon
Sent: Thursday, October 06, 2005
2:14 PM
To: ActiveDir@mail.activedir.org
Subject: RE: [ActiveDir] GPO
Permissions with .vbs
Itll
only schedule tasks on logon scripts, not startup. Someone correct me if
Im wrong.
From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Rich Milburn
Sent: Thursday, October 06, 2005
11:41 AM
To: ActiveDir@mail.activedir.org
Subject: RE: [ActiveDir] GPO
Permissions with .vbs
Can you
set it to be a startup script instead of a logon script (computer configuration
software section of GPO instead of user configuration software
section) then it will run with privs, not as the non-admin.
---
Rich Milburn
MCSE, Microsoft MVP -
Directory Services
Sr Network Analyst, Field
Platform Development
Applebee's International,
Inc.
4551 W. 107th St
Overland Park, KS 66207
913-967-2819
---
I am always doing
that which I can not do, in order that I may learn how to do it. - Pablo
Picasso
From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Harding,
Devon
Sent: Thursday, October 06, 2005
9:48 AM
To: ActiveDir@mail.activedir.org
Subject: RE: [ActiveDir] GPO
Permissions with .vbs
The
problem is the at.exe command can only be run by administrators. How can
I allow non-admins to run at.exe therefore allowing my script to work.
From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Tim Vander Kooi
Sent: Wednesday, October 05, 2005
6:01 PM
To: ActiveDir@mail.activedir.org
Subject: RE: [ActiveDir] GPO
Permissions
RE: [ActiveDir] GPO Permissions with .vbs
Btw, where are you seeing that the job is
scheduled? When I logon as a non-privileged user and click Start, Run
Tasks, there are no jobs scheduled. When I run at.exe from a command
prompt, I get access denied. What are your parameters for
the GPO? (Security settings, Enforced etc)
-Devon
From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Rich Milburn
Sent: Friday, October 07, 2005
12:11 PM
To: ActiveDir@mail.activedir.org
Subject: RE: [ActiveDir] GPO
Permissions with .vbs
I tested several
scenarios:
1) batch file in startup
script in GPO with non-privileged user logging on job appeared in AT.
2) Your script in startup
script in GPO with non-privileged user logging on job appeared in AT.
3) Your script in logon script
in GPO with non-privileged user logging on job did not appear in AT.
So I verified your
results that this does not work from a logon
script with a non-privileged user, and I verified that the same script can schedule jobs on the computer from a startup script.
Hope that helps
Rich
---
Rich Milburn
MCSE, Microsoft MVP -
Directory Services
Sr Network Analyst, Field
Platform Development
Applebee's International,
Inc.
4551 W. 107th St
Overland Park, KS 66207
913-967-2819
---
I am always doing
that which I can not do, in order that I may learn how to do it. - Pablo
Picasso
From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Harding,
Devon
Sent: Friday, October 07, 2005 10:28
AM
To: ActiveDir@mail.activedir.org
Subject: RE: [ActiveDir] GPO
Permissions with .vbs
If I put this in the
Logon Scripts, it runs but just for local administrators. I need this to
run for ALL users.
From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of joe
Sent: Friday, October 07, 2005
11:08 AM
To: ActiveDir@mail.activedir.org
Subject: RE: [ActiveDir] GPO
Permissions with .vbs
Error
messages? Do you get anything? Do you know for sure the script is running?
From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Harding,
Devon
Sent: Friday, October 07, 2005
9:28 AM
To: ActiveDir@mail.activedir.org
Subject: RE: [ActiveDir] GPO
Permissions with .vbs
Well it
didnt work.heres the script:
strComputer = .
strNewCmd = C:\PROGRA~1\INTERN~1\iexplore.exe
-new http://www.domain.com
Set objWMIService =
GetObject(winmgmts:{impersonationLevel=impersonate}!\\
strComputer \root\cimv2)
Set colScheduledTasks
=
objWMIService.ExecQuery(Select * from Win32_ScheduledJob)
For Each objTask in colScheduledTasks
intJobID = objTask.JobID
strCurCmd = objTask.Command
If strCurCmd = strNewCmd Then
Set objInstance =
objWMIService.Get(Win32_ScheduledJob.JobID= intJobID)
objInstance.Delete
End If
Next
Set objNewJob =
objWMIService.Get(Win32_ScheduledJob)
errJobCreated = objNewJob.Create (strNewCmd,
11.00-240, True , 1 OR 2 OR 4 OR 8 OR 16, , ,
JobID)
From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of joe
Sent: Thursday, October 06, 2005
9:01 PM
To: ActiveDir@mail.activedir.org
Subject: RE: [ActiveDir] GPO
Permissions with .vbs
I can't
visualize why it shouldn't work.
From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Harding,
Devon
Sent: Thursday, October 06, 2005
2:14 PM
To: ActiveDir@mail.activedir.org
Subject: RE: [ActiveDir] GPO
Permissions with .vbs
Itll
only schedule tasks on logon scripts, not startup. Someone correct me if
Im wrong.
From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Rich Milburn
Sent: Thursday, October 06, 2005
11:41 AM
To: ActiveDir@mail.activedir.org
Subject: RE: [ActiveDir] GPO
Permissions with .vbs
Can you
set it to be a startup script instead of a logon script (computer configuration
software section of GPO instead of user configuration software
section) then it will run with privs, not as the non-admin.
---
Rich Milburn
MCSE, Microsoft MVP -
Directory Services
Sr Network Analyst, Field
Platform Development
Applebee's International,
Inc.
4551 W. 107th St
Overland Park, KS 66207
913-967-2819
---
I am always doing
that which I can not do, in order that I may learn how to do it. - Pablo
Picasso
From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Harding,
Devon
Sent: Thursday, October 06, 2005
9:48 AM
To: ActiveDir@mail.activedir.org
Subject: RE: [ActiveDir] GPO
Permissions with .vbs
The
problem is the at.exe command can only be run by administrators. How can
I allow non-admins to run at.exe therefore allowing my script to work.
From:
[EMAIL PROTECTED] [mailto:[EMAIL
Re: [ActiveDir] GPO Permissions with .vbs
YA, it will run that way, as startup time script run under LOCALSYSTEM account, which has admin control over machine. On 10/7/05, Rich Milburn [EMAIL PROTECTED] wrote: I tested AT from a batch file in the startup script, it scheduled fine… AT 12:30 "notepad.exe" Created a job. I did not try it from a vbs… Rich --- Rich Milburn MCSE, Microsoft MVP - Directory Services Sr Network Analyst, Field Platform Development Applebee's International, Inc. 4551 W. 107th St Overland Park , KS 66207 913-967-2819 --- I am always doing that which I can not do, in order that I may learn how to do it. - Pablo Picasso From: [EMAIL PROTECTED] [mailto: [EMAIL PROTECTED]] On Behalf Of Kamlesh Parmar Sent: Friday, October 07, 2005 2:00 AM To: ActiveDir@mail.activedir.org Subject: Re: [ActiveDir] GPO Permissions with .vbs At.exe will always reqire admin rights, but normal user account can always schedule task using, Task Scheduler.. So use command line utility schtasks.exe, it should be present on all XP box, don't know about win2K.. just see the help... schtasks.exe /create /? On 10/6/05, Harding, Devon [EMAIL PROTECTED] wrote: The problem is the at.exe command can only be run by administrators. How can I allow non-admins to run at.exe therefore allowing my script to work. From: [EMAIL PROTECTED] [mailto: [EMAIL PROTECTED]] On Behalf Of Tim Vander Kooi Sent: Wednesday, October 05, 2005 6:01 PM To: ActiveDir@mail.activedir.org Subject: RE: [ActiveDir] GPO Permissions with .vbs What is your OS? Is it a user specific task or a computer based task? If it is a task scheduled to run after the user logs on I'm sure it is permissions, or lack there of. Tim Vander Kooi Microsoft Systems Administrator Explorer Pipeline From: [EMAIL PROTECTED] [mailto: [EMAIL PROTECTED]] On Behalf Of Harding, Devon Sent: Wednesday, October 05, 2005 3:56 PM To: ActiveDir@mail.activedir.org Subject: [ActiveDir] GPO Permissions with .vbs I created a GPO for all Domain Users to run a .vbs script to create a Scheduled Task. It works with Domain Admins, but not with regular users. How can I fix this? Devon Harding Windows Systems Engineer Southern Wine Spirits - BSG 954-602-2469 __ This message and any attachments are solely for the intended recipient and may contain confidential or privileged information. If you are not the intended recipient, any disclosure, copying, use or distribution of the information included in the message and any attachments is prohibited. If you have received this communication in error, please notify us by reply e-mail and immediately and permanently delete this message and any attachments. Thank You. -- ~~~ Fortune and Love befriend the bold ~~~ ---APPLEBEE'S INTERNATIONAL, INC. CONFIDENTIALITY NOTICE--- PRIVILEGED / CONFIDENTIAL INFORMATION may be contained in this message or any attachments. This information is strictly confidential and may be subject to attorney-client privilege. This message is intended only for the use of the named addressee. If you are not the intended recipient of this message, unauthorized forwarding, printing, copying, distribution, or using such information is strictly prohibited and may be unlawful. If you have received this in error, you should kindly notify the sender by reply e-mail and immediately destroy this message. Unauthorized interception of this e-mail is a violation of federal criminal law. Applebee's International, Inc. reserves the right to monitor and review the content of all messages sent to and from this e-mail address. Messages sent to or from this e-mail address may be stored on the Applebee's International, Inc. e-mail system. -- ~~~Fortune and Love befriend the bold~~~
Re: [ActiveDir] GPO Permissions with .vbs
This is specific to opening the internet explorer with higher privileges... (nothing to do with script runing at logon or startup) If I knew, that this scheduled job runs under Admin account I can elevate my privileges to local admin, instantly, once the website is opened, I have to just type c:\ into address bar, (c:\ will open with FULL ACCESS) anyway, my actual point is, task will run as scheduled but the Internet explorer will never popup onto user's screen as it is running under LOCALSYSTEM account. you will need to schedule task which runs under normal user account, and AT.exe will not allow you to specify the user account. You will have to create schedule task using schtasks.exe, where u can specify the normal user account under which to run the task. But gotcha is, you will have to provide the password for user under which u want task to run. e.g. schtasks /create /SC WEEKLY /D MON,TUE,WED,THU,FRI /TN myTaskName /TR C:\PROGRA~1\INTERN~1\iexplore.exe -new http://www.slashdot.org /ST 11:00 /IT /RU runuser /RP runpasswd /F but schtasks saves the day as you can schedule the task remotely onto computers. /S is option for specifying the remote system. But, if you want to use th script then issue is saving the password from prying eyes. :) ( I normally use AutoIt.exe to create encrypted EXE out of script, for such tasks) -- KamleshOn 10/7/05, Kamlesh Parmar [EMAIL PROTECTED] wrote: At.exe will always reqire admin rights, but normal user account can always schedule task using, Task Scheduler.. So use command line utility schtasks.exe, it should be present on all XP box, don't know about win2K.. just see the help... schtasks.exe /create /? On 10/6/05, Harding, Devon [EMAIL PROTECTED] wrote: The problem is the at.exe command can only be run by administrators. How can I allow non-admins to run at.exe therefore allowing my script to work. From: [EMAIL PROTECTED] [mailto: [EMAIL PROTECTED]] On Behalf Of Tim Vander KooiSent: Wednesday, October 05, 2005 6:01 PM To: ActiveDir@mail.activedir.orgSubject: RE: [ActiveDir] GPO Permissions with .vbs What is your OS? Is it a user specific task or a computer based task? If it is a task scheduled to run after the user logs on I'm sure it is permissions, or lack there of. Tim Vander Kooi Microsoft Systems Administrator Explorer Pipeline From: [EMAIL PROTECTED] [mailto: [EMAIL PROTECTED]] On Behalf Of Harding, DevonSent: Wednesday, October 05, 2005 3:56 PMTo: ActiveDir@mail.activedir.orgSubject: [ActiveDir] GPO Permissions with .vbs I created a GPO for all Domain Users to run a .vbs script to create a Scheduled Task. It works with Domain Admins, but not with regular users. How can I fix this? Devon Harding Windows Systems Engineer Southern Wine Spirits - BSG 954-602-2469 __ This message and any attachments are solely for the intended recipientand may contain confidential or privileged information. If you are not the intended recipient, any disclosure, copying, use or distribution ofthe information included in the message and any attachments is prohibited. If you have received this communication in error, pleasenotify us by reply e-mail and immediately and permanently delete this message and any attachments. Thank You. -- ~~~ Fortune and Love befriend the bold~~~ -- ~~~Fortune and Love befriend the bold~~~
RE: [ActiveDir] GPO Permissions with .vbs
How would I use schtask to assign to more than one computer. It seems like that may be our only option. I cant believe its that difficult to get a popup of IE on ALL users desktop at a specific time. -Devon From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Kamlesh Parmar Sent: Friday, October 07, 2005 2:45 PM To: ActiveDir@mail.activedir.org Subject: Re: [ActiveDir] GPO Permissions with .vbs This is specific to opening the internet explorer with higher privileges... (nothing to do with script runing at logon or startup) If I knew, that this scheduled job runs under Admin account I can elevate my privileges to local admin, instantly, once the website is opened, I have to just type c:\ into address bar, (c:\ will open with FULL ACCESS) anyway, my actual point is, task will run as scheduled but the Internet explorer will never popup onto user's screen as it is running under LOCALSYSTEM account. you will need to schedule task which runs under normal user account, and AT.exe will not allow you to specify the user account. You will have to create schedule task using schtasks.exe, where u can specify the normal user account under which to run the task. But gotcha is, you will have to provide the password for user under which u want task to run. e.g. schtasks /create /SC WEEKLY /D MON,TUE,WED,THU,FRI /TN myTaskName /TR C:\PROGRA~1\INTERN~1\iexplore.exe -new http://www.slashdot.org /ST 11:00 /IT /RU runuser /RP runpasswd /F but schtasks saves the day as you can schedule the task remotely onto computers. /S is option for specifying the remote system. But, if you want to use th script then issue is saving the password from prying eyes. :) ( I normally use AutoIt.exe to create encrypted EXE out of script, for such tasks) -- Kamlesh On 10/7/05, Kamlesh Parmar [EMAIL PROTECTED] wrote: At.exe will always reqire admin rights, but normal user account can always schedule task using, Task Scheduler.. So use command line utility schtasks.exe, it should be present on all XP box, don't know about win2K.. just see the help... schtasks.exe /create /? On 10/6/05, Harding, Devon [EMAIL PROTECTED] wrote: The problem is the at.exe command can only be run by administrators. How can I allow non-admins to run at.exe therefore allowing my script to work. From: [EMAIL PROTECTED] [mailto: [EMAIL PROTECTED]] On Behalf Of Tim Vander Kooi Sent: Wednesday, October 05, 2005 6:01 PM To: ActiveDir@mail.activedir.org Subject: RE: [ActiveDir] GPO Permissions with .vbs What is your OS? Is it a user specific task or a computer based task? If it is a task scheduled to run after the user logs on I'm sure it is permissions, or lack there of. Tim Vander Kooi Microsoft Systems Administrator Explorer Pipeline From: [EMAIL PROTECTED] [mailto: [EMAIL PROTECTED]] On Behalf Of Harding, Devon Sent: Wednesday, October 05, 2005 3:56 PM To: ActiveDir@mail.activedir.org Subject: [ActiveDir] GPO Permissions with .vbs I created a GPO for all Domain Users to run a .vbs script to create a Scheduled Task. It works with Domain Admins, but not with regular users. How can I fix this? Devon Harding Windows Systems Engineer Southern Wine Spirits - BSG 954-602-2469 __ This message and any attachments are solely for the intended recipient and may contain confidential or privileged information. If you are not the intended recipient, any disclosure, copying, use or distribution of the information included in the message and any attachments is prohibited. If you have received this communication in error, please notify us by reply e-mail and immediately and permanently delete this message and any attachments. Thank You. -- ~~~ Fortune and Love befriend the bold ~~~ -- ~~~ Fortune and Love befriend the bold ~~~
RE: [ActiveDir] GPO Permissions with .vbs
Oh I just chased back through this thread... You want to fire up IE, I didn't catch that before, I didn't look that close at the specific process you wanted fire, just that you wanted to fire a process. You should still be able to do this with a startup script with AT as long as you specify interactive, it should pop in the current interactive session but I would be concerned of the security context it runs in which would be localsystem. In order to schedule something in the security context of another ID you will need to be able to specify userid/password which isn't fun either since someone will probably be able to see it if they are bright. What you want is something that opens an IE window in the context of the currentuser at a specified time. I am not aware of anything that will do that. You almostneed a special app that can be launched by the user in the logon script in their security context that will sleep until the specified time and then fire the app. Here is a point where being an admin with programming skills is nice though you may be able to do this with a script. Have the script fire another process that hides itself from the task bar and pops into the screen at the designated time. I will think aboutthis. There might be a way to pull this off with a perl script. From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Harding, DevonSent: Friday, October 07, 2005 4:46 PMTo: ActiveDir@mail.activedir.orgSubject: RE: [ActiveDir] GPO Permissions with .vbs How would I use schtask to assign to more than one computer. It seems like that may be our only option. I cant believe its that difficult to get a popup of IE on ALL users desktop at a specific time. -Devon From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Kamlesh ParmarSent: Friday, October 07, 2005 2:45 PMTo: ActiveDir@mail.activedir.orgSubject: Re: [ActiveDir] GPO Permissions with .vbs This is specific to opening the internet explorer with higher privileges... (nothing to do with script runing at logon or startup)If I knew, that this scheduled job runs under Admin accountI can elevate my privileges to local admin, instantly, once the website is opened, I have to just type c:\ into address bar, (c:\ will open with FULL ACCESS)anyway, my actual point is, task will run as scheduled but the Internet explorer will never popup onto user's screenas it is running under LOCALSYSTEM account.you will need to schedule task which runs under normal user account, and AT.exe will not allow you to specify the user account.You will have to create schedule task using schtasks.exe, where u can specify the normal user account under which to run the task.But gotcha is, you will have to provide the password for user under which u want task to run.e.g. schtasks /create /SC WEEKLY /D MON,TUE,WED,THU,FRI /TN myTaskName /TR "C:\PROGRA~1\INTERN~1\iexplore.exe -new http://www.slashdot.org" /ST 11:00 /IT /RU runuser /RP runpasswd /Fbut schtasks saves the day as you can schedule the task remotely onto computers. /S is option for specifying the remote system.But, if you want to use th script then issue is saving the password from prying eyes. :) ( I normally use AutoIt.exe to create encrypted EXE out of script, for such tasks)--Kamlesh On 10/7/05, Kamlesh Parmar [EMAIL PROTECTED] wrote: At.exe will always reqire admin rights, but normal user account can always schedule task using, Task Scheduler.. So use command line utility schtasks.exe, it should be present on all XP box, don't know about win2K.. just see the help... schtasks.exe /create /? On 10/6/05, Harding, Devon [EMAIL PROTECTED] wrote: The problem is the at.exe command can only be run by administrators. How can I allow non-admins to run at.exe therefore allowing my script to work. From: [EMAIL PROTECTED] [mailto: [EMAIL PROTECTED]] On Behalf Of Tim Vander KooiSent: Wednesday, October 05, 2005 6:01 PMTo: ActiveDir@mail.activedir.orgSubject: RE: [ActiveDir] GPO Permissions with .vbs What is your OS? Is it a user specific task or a computer based task? If it is a task scheduled to run after the user logs on I'm sure it is permissions, or lack there of. Tim Vander Kooi Microsoft Systems Administrator Explorer Pipeline From: [EMAIL PROTECTED] [mailto: [EMAIL PROTECTED]] On Behalf Of Harding, DevonSent: Wednesday, October 05, 2005 3:56 PMTo: ActiveDir@mail.activedir.orgSubject: [ActiveDir] GPO Permissions with .vbs I created a GPO for all Domain Users to run a .vbs script to create a Scheduled Task. It works with Domain Admins, but not with regular users. How can I fix this? Devon Harding Windows Systems Engineer Southern Wine Spirits - BSG 954-602-2469 __This message and any attachments are solely for the intended recipientand may contain confidential or privileged information. If you are not the intended recipient, any
RE: [ActiveDir] GPO Permissions with .vbs
This should be a piece of cake to do with a .net app. It's got an easy option to hide from the taskbar, so you don't have to call the Win32 API to do that (not that its hard...), it has a couple of timer classes, and it has a Process class you can use to kick off a process. Sounds like a compelling reason to learn C# or VB.Net to me. ;) Thanks,Brian Desmond [EMAIL PROTECTED] c - 312.731.3132 From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of joeSent: Friday, October 07, 2005 9:02 PMTo: ActiveDir@mail.activedir.orgSubject: RE: [ActiveDir] GPO Permissions with .vbs Oh I just chased back through this thread... You want to fire up IE, I didn't catch that before, I didn't look that close at the specific process you wanted fire, just that you wanted to fire a process. You should still be able to do this with a startup script with AT as long as you specify interactive, it should pop in the current interactive session but I would be concerned of the security context it runs in which would be localsystem. In order to schedule something in the security context of another ID you will need to be able to specify userid/password which isn't fun either since someone will probably be able to see it if they are bright. What you want is something that opens an IE window in the context of the currentuser at a specified time. I am not aware of anything that will do that. You almostneed a special app that can be launched by the user in the logon script in their security context that will sleep until the specified time and then fire the app. Here is a point where being an admin with programming skills is nice though you may be able to do this with a script. Have the script fire another process that hides itself from the task bar and pops into the screen at the designated time. I will think aboutthis. There might be a way to pull this off with a perl script. From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Harding, DevonSent: Friday, October 07, 2005 4:46 PMTo: ActiveDir@mail.activedir.orgSubject: RE: [ActiveDir] GPO Permissions with .vbs How would I use schtask to assign to more than one computer. It seems like that may be our only option. I cant believe its that difficult to get a popup of IE on ALL users desktop at a specific time. -Devon From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Kamlesh ParmarSent: Friday, October 07, 2005 2:45 PMTo: ActiveDir@mail.activedir.orgSubject: Re: [ActiveDir] GPO Permissions with .vbs This is specific to opening the internet explorer with higher privileges... (nothing to do with script runing at logon or startup)If I knew, that this scheduled job runs under Admin accountI can elevate my privileges to local admin, instantly, once the website is opened, I have to just type c:\ into address bar, (c:\ will open with FULL ACCESS)anyway, my actual point is, task will run as scheduled but the Internet explorer will never popup onto user's screenas it is running under LOCALSYSTEM account.you will need to schedule task which runs under normal user account, and AT.exe will not allow you to specify the user account.You will have to create schedule task using schtasks.exe, where u can specify the normal user account under which to run the task.But gotcha is, you will have to provide the password for user under which u want task to run.e.g. schtasks /create /SC WEEKLY /D MON,TUE,WED,THU,FRI /TN myTaskName /TR "C:\PROGRA~1\INTERN~1\iexplore.exe -new http://www.slashdot.org" /ST 11:00 /IT /RU runuser /RP runpasswd /Fbut schtasks saves the day as you can schedule the task remotely onto computers. /S is option for specifying the remote system.But, if you want to use th script then issue is saving the password from prying eyes. :) ( I normally use AutoIt.exe to create encrypted EXE out of script, for such tasks)--Kamlesh On 10/7/05, Kamlesh Parmar [EMAIL PROTECTED] wrote: At.exe will always reqire admin rights, but normal user account can always schedule task using, Task Scheduler.. So use command line utility schtasks.exe, it should be present on all XP box, don't know about win2K.. just see the help... schtasks.exe /create /? On 10/6/05, Harding, Devon [EMAIL PROTECTED] wrote: The problem is the at.exe command can only be run by administrators. How can I allow non-admins to run at.exe therefore allowing my script to work. From: [EMAIL PROTECTED] [mailto: [EMAIL PROTECTED]] On Behalf Of Tim Vander KooiSent: Wednesday, October 05, 2005 6:01 PMTo: ActiveDir@mail.activedir.orgSubject: RE: [ActiveDir] GPO Permissions with .vbs What is your OS? Is it a user specific task or a computer based task? If it is a task scheduled to run after the user logs on I'm sure it is permissions, or lack there of. Tim Vander Kooi Microsoft Systems Administrator Explorer Pipeline From: [EMAIL PROTECTED] [mailto: [EMAIL PROTECTED]] On Behalf
RE: [ActiveDir] GPO Permissions with .vbs
Now that I have a nice steak from Texas Roadhouse in my
belly I can think straight. :o)
Assuming the perl script is called
timedfire.pl
my
$d1="10/7/2005";my $t1="23:04";my $cmd="c:\\progra~1\\intern~1\\iexplore.exe -new
www.joeware.net";
my
($mon,$day,$year)=split(/\//,$d1);my ($hour,$min)=split(/:/,$t1);my
$cmp=GetCmpVal($year,$mon,$day,$hour,$min);$curr=GetCurrentTime();while($cmp$curr){
sleep 60; $curr=GetCurrentTime();}
exec $cmd;
sub
GetCmpVal{ return
sprintf("%04s%02s%02s%02s%02s",@_);}
sub
GetCurrentTime{ my @lt=localtime(); return
GetCmpVal($lt[5]+1900,$lt[4]+1,$lt[3],$lt[2],$lt[1]);}
You should be able to put in the logon
script
quiet timedfire.pl
And you can get quiet from http://www.joeware.net/win/free/tools/quiet.htm
That can be further reduced but I wanted it to be
readable. If someone wants to convert to _vbscript_, that might be fun for people
who don't do perl.
joe
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Brian
DesmondSent: Friday, October 07, 2005 9:15 PMTo:
ActiveDir@mail.activedir.orgSubject: RE: [ActiveDir] GPO Permissions
with .vbs
This should be a piece of
cake to do with a .net app. It's got an easy option to hide from the taskbar, so
you don't have to call the Win32 API to do that (not that its hard...), it has a
couple of timer classes, and it has a Process class you can use to kick off a
process. Sounds like a compelling reason to learn C# or VB.Net to me.
;)
Thanks,Brian Desmond
[EMAIL PROTECTED]
c -
312.731.3132
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of
joeSent: Friday, October 07, 2005 9:02 PMTo:
ActiveDir@mail.activedir.orgSubject: RE: [ActiveDir] GPO Permissions
with .vbs
Oh I just chased back through this thread... You want to
fire up IE, I didn't catch that before, I didn't look that close at the specific
process you wanted fire, just that you wanted to fire a process. You should
still be able to do this with a startup script with AT as long as you specify
interactive, it should pop in the current interactive session but I would be
concerned of the security context it runs in which would be localsystem. In
order to schedule something in the security context of another ID you will need
to be able to specify userid/password which isn't fun either since someone will
probably be able to see it if they are bright.
What you want is something that opens an IE window in the
context of the currentuser at a specified time. I am not aware of anything
that will do that. You almostneed a special app that can be launched by
the user in the logon script in their security context that will sleep until the
specified time and then fire the app. Here is a point where being an admin with
programming skills is nice though you may be able to do this with a script. Have
the script fire another process that hides itself from the task bar and pops
into the screen at the designated time.
I will think aboutthis. There might be a way to pull
this off with a perl script.
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Harding,
DevonSent: Friday, October 07, 2005 4:46 PMTo:
ActiveDir@mail.activedir.orgSubject: RE: [ActiveDir] GPO Permissions
with .vbs
How would I use schtask
to assign to more than one computer. It seems like that may be our only
option.
I cant believe its
that difficult to get a popup of IE on ALL users desktop at a specific
time.
-Devon
From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]
On Behalf Of Kamlesh
ParmarSent: Friday, October
07, 2005 2:45 PMTo:
ActiveDir@mail.activedir.orgSubject: Re: [ActiveDir] GPO Permissions
with .vbs
This is specific to
opening the internet explorer with higher privileges... (nothing to do with
script runing at logon or startup)If I knew, that this scheduled job
runs under Admin accountI can elevate my privileges to local admin,
instantly, once the website is opened, I have to just type c:\ into
address bar, (c:\ will open with FULL ACCESS)anyway, my actual
point is, task will run as scheduled but the
Internet explorer will never popup onto user's screenas it is running under
LOCALSYSTEM account.you will need to schedule task which runs
under normal user account, and AT.exe will not allow you to specify the user
account.You will have to create schedule task using schtasks.exe, where
u can specify the normal user account under which to run the task.But gotcha
is, you will have to provide the password for user under which u want task to
run.e.g. schtasks /create /SC WEEKLY /D MON,TUE,WED,THU,FRI /TN
myTaskName /TR "C:\PROGRA~1\INTERN~1\iexplore.exe -new http://www.slashdot.org" /ST 11:00 /IT /RU
runuser /RP runpasswd /Fbut schtasks saves the day as you can schedule
the task remotely onto computers. /S is option for specifying the remote
system.But, if you want to use th script then issue is saving the
password from prying eyes. :
RE: [ActiveDir] GPO Permissions with .vbs
The problem is the at.exe command can only be run by administrators. How can I allow non-admins to run at.exe therefore allowing my script to work. From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Tim Vander Kooi Sent: Wednesday, October 05, 2005 6:01 PM To: ActiveDir@mail.activedir.org Subject: RE: [ActiveDir] GPO Permissions with .vbs What is your OS? Is it a user specific task or a computer based task? If it is a task scheduled to run after the user logs on I'm sure it is permissions, or lack there of. Tim Vander Kooi Microsoft Systems Administrator Explorer Pipeline From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Harding, Devon Sent: Wednesday, October 05, 2005 3:56 PM To: ActiveDir@mail.activedir.org Subject: [ActiveDir] GPO Permissions with .vbs I created a GPO for all Domain Users to run a .vbs script to create a Scheduled Task. It works with Domain Admins, but not with regular users. How can I fix this? Devon Harding Windows Systems Engineer Southern Wine Spirits - BSG 954-602-2469 __ This message and any attachments are solely for the intended recipient and may contain confidential or privileged information. If you are not the intended recipient, any disclosure, copying, use or distribution of the information included in the message and any attachments is prohibited. If you have received this communication in error, please notify us by reply e-mail and immediately and permanently delete this message and any attachments. Thank You.
RE: [ActiveDir] GPO Permissions with .vbs
Can you set it to be a startup script instead of a logon script (computer configuration software section of GPO instead of user configuration software section) then it will run with privs, not as the non-admin. --- Rich Milburn MCSE, Microsoft MVP - Directory Services Sr Network Analyst, Field Platform Development Applebee's International, Inc. 4551 W. 107th St Overland Park, KS 66207 913-967-2819 --- I am always doing that which I can not do, in order that I may learn how to do it. - Pablo Picasso From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Harding, Devon Sent: Thursday, October 06, 2005 9:48 AM To: ActiveDir@mail.activedir.org Subject: RE: [ActiveDir] GPO Permissions with .vbs The problem is the at.exe command can only be run by administrators. How can I allow non-admins to run at.exe therefore allowing my script to work. From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Tim Vander Kooi Sent: Wednesday, October 05, 2005 6:01 PM To: ActiveDir@mail.activedir.org Subject: RE: [ActiveDir] GPO Permissions with .vbs What is your OS? Is it a user specific task or a computer based task? If it is a task scheduled to run after the user logs on I'm sure it is permissions, or lack there of. Tim Vander Kooi Microsoft Systems Administrator Explorer Pipeline From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Harding, Devon Sent: Wednesday, October 05, 2005 3:56 PM To: ActiveDir@mail.activedir.org Subject: [ActiveDir] GPO Permissions with .vbs I created a GPO for all Domain Users to run a .vbs script to create a Scheduled Task. It works with Domain Admins, but not with regular users. How can I fix this? Devon Harding Windows Systems Engineer Southern Wine Spirits - BSG 954-602-2469 __ This message and any attachments are solely for the intended recipient and may contain confidential or privileged information. If you are not the intended recipient, any disclosure, copying, use or distribution of the information included in the message and any attachments is prohibited. If you have received this communication in error, please notify us by reply e-mail and immediately and permanently delete this message and any attachments. Thank You. ---APPLEBEE'S INTERNATIONAL, INC. CONFIDENTIALITY NOTICE--- PRIVILEGED / CONFIDENTIAL INFORMATION may be contained in this message or any attachments. This information is strictly confidential and may be subject to attorney-client privilege. This message is intended only for the use of the named addressee. If you are not the intended recipient of this message, unauthorized forwarding, printing, copying, distribution, or using such information is strictly prohibited and may be unlawful. If you have received this in error, you should kindly notify the sender by reply e-mail and immediately destroy this message. Unauthorized interception of this e-mail is a violation of federal criminal law. Applebee's International, Inc. reserves the right to monitor and review the content of all messages sent to and from this e-mail address. Messages sent to or from this e-mail address may be stored on the Applebee's International, Inc. e-mail system.
RE: [ActiveDir] GPO Permissions with .vbs
Itll only schedule tasks on logon scripts, not startup. Someone correct me if Im wrong. From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Rich Milburn Sent: Thursday, October 06, 2005 11:41 AM To: ActiveDir@mail.activedir.org Subject: RE: [ActiveDir] GPO Permissions with .vbs Can you set it to be a startup script instead of a logon script (computer configuration software section of GPO instead of user configuration software section) then it will run with privs, not as the non-admin. --- Rich Milburn MCSE, Microsoft MVP - Directory Services Sr Network Analyst, Field Platform Development Applebee's International, Inc. 4551 W. 107th St Overland Park, KS 66207 913-967-2819 --- I am always doing that which I can not do, in order that I may learn how to do it. - Pablo Picasso From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Harding, Devon Sent: Thursday, October 06, 2005 9:48 AM To: ActiveDir@mail.activedir.org Subject: RE: [ActiveDir] GPO Permissions with .vbs The problem is the at.exe command can only be run by administrators. How can I allow non-admins to run at.exe therefore allowing my script to work. From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Tim Vander Kooi Sent: Wednesday, October 05, 2005 6:01 PM To: ActiveDir@mail.activedir.org Subject: RE: [ActiveDir] GPO Permissions with .vbs What is your OS? Is it a user specific task or a computer based task? If it is a task scheduled to run after the user logs on I'm sure it is permissions, or lack there of. Tim Vander Kooi Microsoft Systems Administrator Explorer Pipeline From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Harding, Devon Sent: Wednesday, October 05, 2005 3:56 PM To: ActiveDir@mail.activedir.org Subject: [ActiveDir] GPO Permissions with .vbs I created a GPO for all Domain Users to run a .vbs script to create a Scheduled Task. It works with Domain Admins, but not with regular users. How can I fix this? Devon Harding Windows Systems Engineer Southern Wine Spirits - BSG 954-602-2469 __ This message and any attachments are solely for the intended recipient and may contain confidential or privileged information. If you are not the intended recipient, any disclosure, copying, use or distribution of the information included in the message and any attachments is prohibited. If you have received this communication in error, please notify us by reply e-mail and immediately and permanently delete this message and any attachments. Thank You. ---APPLEBEE'S INTERNATIONAL, INC. CONFIDENTIALITY NOTICE--- PRIVILEGED / CONFIDENTIAL INFORMATION may be contained in this message or any attachments. This information is strictly confidential and may be subject to attorney-client privilege. This message is intended only for the use of the named addressee. If you are not the intended recipient of this message, unauthorized forwarding, printing, copying, distribution, or using such information is strictly prohibited and may be unlawful. If you have received this in error, you should kindly notify the sender by reply e-mail and immediately destroy this message. Unauthorized interception of this e-mail is a violation of federal criminal law. Applebee's International, Inc. reserves the right to monitor and review the content of all messages sent to and from this e-mail address. Messages sent to or from this e-mail address may be stored on the Applebee's International, Inc. e-mail system.
RE: [ActiveDir] GPO Permissions with .vbs
Under Computer Configuration - Windows Settings - Scripts you'll find Startup and Shutdown. These run before the Logon scripts and after the Logoff scripts, respectively. From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Harding, DevonSent: Thursday, October 06, 2005 12:14 PMTo: ActiveDir@mail.activedir.orgSubject: RE: [ActiveDir] GPO Permissions with .vbs Itll only schedule tasks on logon scripts, not startup. Someone correct me if Im wrong. From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Rich MilburnSent: Thursday, October 06, 2005 11:41 AMTo: ActiveDir@mail.activedir.orgSubject: RE: [ActiveDir] GPO Permissions with .vbs Can you set it to be a startup script instead of a logon script (computer configuration software section of GPO instead of user configuration software section) then it will run with privs, not as the non-admin. ---Rich MilburnMCSE, Microsoft MVP - Directory ServicesSr Network Analyst, Field Platform DevelopmentApplebee's International, Inc.4551 W. 107th StOverland Park, KS 66207913-967-2819---"I am always doing that which I can not do, in order that I may learn how to do it." - Pablo Picasso From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Harding, DevonSent: Thursday, October 06, 2005 9:48 AMTo: ActiveDir@mail.activedir.orgSubject: RE: [ActiveDir] GPO Permissions with .vbs The problem is the at.exe command can only be run by administrators. How can I allow non-admins to run at.exe therefore allowing my script to work. From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Tim Vander KooiSent: Wednesday, October 05, 2005 6:01 PMTo: ActiveDir@mail.activedir.orgSubject: RE: [ActiveDir] GPO Permissions with .vbs What is your OS? Is it a user specific task or a computer based task? If it is a task scheduled to run after the user logs on I'm sure it is permissions, or lack there of. Tim Vander Kooi Microsoft Systems Administrator Explorer Pipeline From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Harding, DevonSent: Wednesday, October 05, 2005 3:56 PMTo: ActiveDir@mail.activedir.orgSubject: [ActiveDir] GPO Permissions with .vbs I created a GPO for all Domain Users to run a .vbs script to create a Scheduled Task. It works with Domain Admins, but not with regular users. How can I fix this? Devon Harding Windows Systems Engineer Southern Wine Spirits - BSG 954-602-2469 __This message and any attachments are solely for the intended recipientand may contain confidential or privileged information. If you are notthe intended recipient, any disclosure, copying, use or distribution ofthe information included in the message and any attachments isprohibited. If you have received this communication in error, pleasenotify us by reply e-mail and immediately and permanently delete thismessage and any attachments. Thank You. ---APPLEBEE'S INTERNATIONAL, INC. CONFIDENTIALITY NOTICE--- PRIVILEGED / CONFIDENTIAL INFORMATION may be contained in this message or any attachments. This information is strictly confidential and may be subject to attorney-client privilege. This message is intended only for the use of the named addressee. If you are not the intended recipient of this message, unauthorized forwarding, printing, copying, distribution, or using such information is strictly prohibited and may be unlawful. If you have received this in error, you should kindly notify the sender by reply e-mail and immediately destroy this message. Unauthorized interception of this e-mail is a violation of federal criminal law. Applebee's International, Inc. reserves the right to monitor and review the content of all messages sent to and from this e-mail address. Messages sent to or from this e-mail address may be stored on the Applebee's International, Inc. e-mail system.
RE: [ActiveDir] GPO Permissions with .vbs
I can't visualize why it shouldn't work. From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Harding, DevonSent: Thursday, October 06, 2005 2:14 PMTo: ActiveDir@mail.activedir.orgSubject: RE: [ActiveDir] GPO Permissions with .vbs Itll only schedule tasks on logon scripts, not startup. Someone correct me if Im wrong. From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Rich MilburnSent: Thursday, October 06, 2005 11:41 AMTo: ActiveDir@mail.activedir.orgSubject: RE: [ActiveDir] GPO Permissions with .vbs Can you set it to be a startup script instead of a logon script (computer configuration software section of GPO instead of user configuration software section) then it will run with privs, not as the non-admin. ---Rich MilburnMCSE, Microsoft MVP - Directory ServicesSr Network Analyst, Field Platform DevelopmentApplebee's International, Inc.4551 W. 107th StOverland Park, KS 66207913-967-2819---"I am always doing that which I can not do, in order that I may learn how to do it." - Pablo Picasso From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Harding, DevonSent: Thursday, October 06, 2005 9:48 AMTo: ActiveDir@mail.activedir.orgSubject: RE: [ActiveDir] GPO Permissions with .vbs The problem is the at.exe command can only be run by administrators. How can I allow non-admins to run at.exe therefore allowing my script to work. From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Tim Vander KooiSent: Wednesday, October 05, 2005 6:01 PMTo: ActiveDir@mail.activedir.orgSubject: RE: [ActiveDir] GPO Permissions with .vbs What is your OS? Is it a user specific task or a computer based task? If it is a task scheduled to run after the user logs on I'm sure it is permissions, or lack there of. Tim Vander Kooi Microsoft Systems Administrator Explorer Pipeline From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Harding, DevonSent: Wednesday, October 05, 2005 3:56 PMTo: ActiveDir@mail.activedir.orgSubject: [ActiveDir] GPO Permissions with .vbs I created a GPO for all Domain Users to run a .vbs script to create a Scheduled Task. It works with Domain Admins, but not with regular users. How can I fix this? Devon Harding Windows Systems Engineer Southern Wine Spirits - BSG 954-602-2469 __This message and any attachments are solely for the intended recipientand may contain confidential or privileged information. If you are notthe intended recipient, any disclosure, copying, use or distribution ofthe information included in the message and any attachments isprohibited. If you have received this communication in error, pleasenotify us by reply e-mail and immediately and permanently delete thismessage and any attachments. Thank You. ---APPLEBEE'S INTERNATIONAL, INC. CONFIDENTIALITY NOTICE--- PRIVILEGED / CONFIDENTIAL INFORMATION may be contained in this message or any attachments. This information is strictly confidential and may be subject to attorney-client privilege. This message is intended only for the use of the named addressee. If you are not the intended recipient of this message, unauthorized forwarding, printing, copying, distribution, or using such information is strictly prohibited and may be unlawful. If you have received this in error, you should kindly notify the sender by reply e-mail and immediately destroy this message. Unauthorized interception of this e-mail is a violation of federal criminal law. Applebee's International, Inc. reserves the right to monitor and review the content of all messages sent to and from this e-mail address. Messages sent to or from this e-mail address may be stored on the Applebee's International, Inc. e-mail system.
